@cabane/companion 0.6.144 → 0.6.146

package/dist/runtime.js

@@ -73,18 +73,15 @@ var prepareHookSchema = z.object({
   // default is generous; a hook that hangs past this is killed and the turn
   // fails with a clear timeout message rather than pinning the companion.
   timeoutMs: z.number().int().positive().optional(),
-  // CT943: re-invoke the hook on turns where a prepared result already exists,
-  // in VALIDATE mode — the cached result is handed back as `prepared` and the
-  // hook's stdout is ignored, so the cwd provably cannot move. Its only power
-  // is to exit non-zero and fail the turn.
+  // Re-invoke the hook when a prepared result already exists, in VALIDATE
+  // mode: the cached result is handed back as `prepared` and stdout is
+  // ignored, so the cwd cannot move. Its only power is to exit non-zero and
+  // fail the turn. The hook resolves once per (conversation, agent), so a
+  // later message asking for a different environment is otherwise silently
+  // ignored; this lets a hook refuse it out loud.
   //
-  // Why it exists: the hook runs exactly once per (conversation, agent), so a
-  // later message asking for a different environment can't be honoured. Without
-  // this, it is silently ignored — the host knows and says nothing, which is
-  // the worst available outcome. An opt-in hook can now refuse it out loud.
-  //
-  // Default OFF, and deliberately: an operator hook that provisions
-  // unconditionally must not start running on every turn because it upgraded.
+  // Default OFF: a hook that provisions unconditionally must not start
+  // running on every turn because the companion upgraded.
   validateCached: z.boolean().optional(),
   // Independent operator-owned reporter. Receives sanitized failure metadata
   // on stdin; never re-enters this hook and cannot change the turn outcome.
@@ -150,16 +147,15 @@ var runPrepareHook = (hook, input) => {
           CABANE_AGENT_USERNAME: input.agentUsername,
           CABANE_RUNTIME: input.runtime ?? "",
           CABANE_HOST_ACCESS: input.hostAccess ? "1" : "0",
-          // CT319: the conversation anchor is gone. These are kept as DEPRECATED
-          // back-compat constants so an old user prepare script that still reads
-          // them doesn't crash; a hook should key off CABANE_TRIGGER_ENTRY_PATHS.
+          // DEPRECATED constants, kept so an old prepare script that reads them
+          // doesn't crash; a hook should key off CABANE_TRIGGER_ENTRY_PATHS.
           CABANE_ANCHOR_KIND: "workspace",
           CABANE_ANCHOR_PATH: "",
-          // CT317: newline-joined — workspace paths never contain a newline, so a
+          // Newline-joined — workspace paths never contain a newline, so a
           // hook splits on `\n` unambiguously. Empty string when none.
           CABANE_TRIGGER_ENTRY_PATHS: input.triggerEntryPaths.join("\n"),
           CABANE_CONVERSATION_TITLE: input.title ?? "",
-          // CT943: the dispatching message's text, and — in validate mode only —
+          // The dispatching message's text, and — in validate mode only —
           // the prepared result the hook is being asked to check this dispatch
           // against. Both empty/absent on an ordinary first run.
           CABANE_TRIGGER_MESSAGE: input.messageBody ?? "",
@@ -253,18 +249,17 @@ function configPath() {
 var localAgentConfigSchema = z2.object({
   cwd: z2.string().optional(),
   prepareHook: prepareHookSchema.optional(),
-  // CT289: the Claude Code auto-memory escape hatch. Auto-memory is forced OFF
-  // by default on every companion (memory belongs in the Cabane workspace, and a
-  // shared companion would otherwise pool one cwd-keyed memory dir across users).
-  // On a companion you run yourself, set `claudeCode: { autoMemory: true }` to hand
-  // auto-memory back to your own `~/.claude/settings.json` — Cabane then stops
+  // The Claude Code auto-memory escape hatch. Auto-memory is forced OFF by
+  // default (memory belongs in the Cabane workspace, and a shared companion
+  // would pool one cwd-keyed memory dir across users). On a companion you run
+  // yourself, `claudeCode: { autoMemory: true }` hands auto-memory back to your
+  // own `~/.claude/settings.json` — Cabane then stops
   // injecting the off switch and your normal Claude Code memory workflow applies
   // (in coding mode, where the checkout's project settings are read).
   claudeCode: z2.object({ autoMemory: z2.boolean().optional() }).strict().optional(),
-  // CT1693: this agent's exception to `runners.sandbox` — an ops agent that
-  // runs with the machine on a sandboxed device, or one sandboxed agent on a
-  // device that isn't. Absent is "inherit"; see `runnerSandboxFor`. Only on a
-  // row keyed by the agent's id (`agentsConfigSchema`).
+  // This agent's exception to `runners.sandbox`: an ops agent that runs with
+  // the machine on a sandboxed device, or one sandboxed agent on a device that
+  // isn't. Absent is "inherit". Only on a row keyed by the agent's id.
   sandbox: z2.enum(["os", "none"]).optional()
 }).strict();
 var AGENT_ID_KEY = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
@@ -280,9 +275,8 @@ var agentsConfigSchema = z2.record(z2.string(), localAgentConfigSchema).superRef
   }
 });
 var companionConfigSchema = z2.object({
-  // The cabane instance this device is paired with. SJ515: https-enforced
-  // (loopback exempt) so a hand-edited config can't smuggle a plaintext-http
-  // base URL onto the MITM-able channel the device token + prompt ride.
+  // https-enforced (loopback exempt), so a hand-edited config can't put the
+  // device token and prompt on a plaintext channel.
   baseUrl: z2.string().url().refine(isAllowedBaseUrl, {
     message: "baseUrl must be https (loopback http is allowed for local dev only)"
   }),
@@ -300,91 +294,59 @@ var companionConfigSchema = z2.object({
   // agentId / username / `slug/username`. Hand-added by the operator; the companion
   // never writes this (it only persists credentials + the device, elsewhere).
   agents: agentsConfigSchema.optional(),
-  // CT1095: the DEVICE-LEVEL prepare hook — one entry that applies to every agent
-  // assigned to this device, unless that agent's own `agents` row names a hook of
-  // its own.
-  //
-  // Until now `prepareHook` existed only under `agents[<id>]`, which made the
-  // config a second silent roster: a device whose provisioning is genuinely
-  // per-device (ours resolves a directory from the conversation and agent ids the
-  // companion already hands the hook) still had to list every agent by id, and an
-  // agent nobody remembered to add got no hook at all — no error, no log, just a
-  // turn that started in the operator's `$HOME`. That is how @dale woke in
-  // `/home/joshed` on 2026-08-17 with a perfectly correct dispatch.
-  //
-  // Absent → nothing changes for anyone, which is why this can land inert: a
-  // device with no device-level entry behaves exactly as it did before. A hook
-  // that fails still fails the dispatch loudly, as now.
+  // The DEVICE-LEVEL prepare hook, for every agent assigned here unless its own
+  // `agents` row names one. Per-agent hooks alone make the config a second
+  // silent roster: an agent nobody listed gets no hook and no error, and starts
+  // in the operator's `$HOME` (an agent woke in `/home/joshed` this way on
+  // 2026-08-17).
   prepareHook: prepareHookSchema.optional(),
-  // CT1085 §9: `dashboardPort` and `autoOpen` are READ AND IGNORED by the CLI —
-  // it binds no port and opens no browser. They stay in the schema (rather than
-  // becoming a strict-mode parse error on an existing config file) and still mean
-  // what they say to the Electron shell, the one front-end that renders a
-  // dashboard. `logLevel` is unaffected: pino level, live-editable.
+  // `dashboardPort` and `autoOpen` are IGNORED by the CLI (no port, no browser)
+  // but stay in the schema so an existing file still parses; the Electron shell
+  // reads them. `logLevel` is pino's level, live-editable.
   dashboardPort: z2.number().int().min(1).max(65535).optional(),
   autoOpen: z2.boolean().optional(),
   logLevel: z2.enum(["warn", "info", "debug"]).optional(),
   logFormat: z2.enum(["human", "json"]).optional(),
-  // CT270: the opencode runtime, when the operator runs one on this machine. The
-  // operator installs opencode, starts `opencode serve` (auth via opencode's own
-  // `/connect` — Cabane never sees provider keys), and points the companion at it
-  // here. Setting this makes the device advertise the `opencode` runtime on its
-  // heartbeat manifest (so the server offers DeepSeek/opencode models here and
-  // routes those turns to this device) AND registers the opencode adapter in the
-  // dispatcher. Absent → the device is claude-code-only, exactly as before.
+  // An `opencode serve` the operator runs here (auth via opencode's own
+  // `/connect`; Cabane never sees provider keys). Set, the device advertises the
+  // `opencode` runtime and registers its adapter.
   opencode: z2.object({
     serverUrl: z2.string().url()
   }).strict().optional(),
-  // CT1082: the Claude Code runtime, when the user connected it on this machine.
-  // The change this task exists for: Claude Code used to be the one harness a
-  // device exposed with no configuration — a `claude --version` exit-0 was taken as
-  // consent — and it is now the third config-driven harness, opted into exactly
-  // like codex. CT1379: the binary that must be there is the Agent SDK's own
-  // bundled executable — the file a turn actually launches — not the user's
-  // `claude` on PATH, which the SDK never runs. The manifest advertises
-  // claude-code only when this block says so AND that binary resolves.
+  // Whether the user connected Claude Code on this machine: consent, opted into
+  // like codex. The manifest advertises claude-code only when this says so AND
+  // the Agent SDK's bundled executable resolves (not `claude` on PATH, which the
+  // SDK never runs).
   //
-  // The block's PRESENCE is also the migration marker (see `migrateConnectedHarnesses`).
-  // Absent means the config predates this task — a device whose user was never
-  // asked — and the migration grandfathers it on first start. So every config
-  // written from here on carries the block explicitly, including a freshly-paired
-  // one, which starts at `enabled: false`: a new device is connected to nothing
-  // until its user says otherwise.
+  // The block's PRESENCE is also the migration marker
+  // (`migrateConnectedHarnesses`): absent means a config whose user was never
+  // asked. So every config written carries it, a fresh pair at `enabled: false`.
   //
-  // Not to be confused with the per-agent `agents.<key>.claudeCode.autoMemory`
-  // above — that's one agent's memory switch, this is the device's connected set.
+  // Not the per-agent `agents.<key>.claudeCode.autoMemory`, one agent's memory
+  // switch.
   claudeCode: z2.object({
     enabled: z2.boolean().optional()
   }).strict().optional(),
-  // CT481: the codex runtime, when the operator runs Codex on this machine. Unlike
-  // opencode (a long-lived `opencode serve` addressed by URL), Codex is a local CLI
-  // the `@openai/codex-sdk` spawns per turn — so the config is just an opt-in flag,
-  // not a server address. The operator installs Codex + logs in (`codex login`, or
-  // `CODEX_API_KEY` — Cabane never sees the key) and sets `{ "codex": { "enabled":
-  // true } }`. Presence of the block enables it (an explicit `enabled: false`
-  // keeps the block but turns it off). Absent → the device doesn't offer codex.
-  // CT1379: enabling is now half the answer, not all of it — the manifest and the
-  // adapter registry additionally require the SDK's vendored `codex` binary to
-  // resolve, because the enable flag alone advertised a runtime a device with a
-  // half-installed platform package could not start.
+  // Codex is a local CLI the SDK spawns per turn, so this is an opt-in flag, not
+  // an address. The operator logs in (`codex login` or `CODEX_API_KEY`; Cabane
+  // never sees the key). The block's presence enables it; `enabled: false` turns
+  // it off. Half the answer: advertising also requires the SDK's vendored
+  // `codex` binary to resolve.
   codex: z2.object({
     enabled: z2.boolean().optional()
   }).strict().optional(),
-  // CT1679: run each turn in a child runner process instead of in this one.
-  // Absent, or `enabled: false`, is the in-process path, untouched. `sandbox`
-  // wraps the runner in an OS sandbox where the host supports one; `'none'`
-  // (the default) runs it as a plain child beside this process, a supported
-  // configuration in its own right rather than a degraded one.
-  // CT1684: `policy` is what the OS sandbox lets a turn reach, read and hold
-  // (`runner/sandbox-policy.ts`). It is validated there rather than here, so a
-  // bad policy refuses the turns it governs, with the field named, instead of
-  // keeping the companion from starting at all.
+  // Run each turn in a child runner process. Absent or `enabled: false` is the
+  // in-process path. `sandbox: 'os'` wraps the runner in an OS sandbox where the
+  // host supports one; `'none'` (the default) is a plain child, supported in its
+  // own right. `policy` is what the sandbox lets a turn reach, read and hold,
+  // validated in `runner/sandbox-policy.ts` so a bad policy refuses the turns it
+  // governs, field named, instead of stopping the companion starting.
   runners: z2.object({
     enabled: z2.boolean().optional(),
     provider: z2.enum(["local-process", "docker"]).optional(),
     sandbox: z2.enum(["os", "none"]).optional(),
-    // CT1681: the `docker` provider — a container per conversation and agent,
-    // from one image, on a network whose only way out is an allow-listed proxy.
+    // A container per conversation and agent, from one image, on a network
+    // whose only way out is an allow-listed proxy.
     docker: z2.object({
       // The base image a container runs. Default: the one this companion
       // builds from its own Dockerfile on first use. One named here must
@@ -877,9 +839,8 @@ var DEFAULT_OPENCODE_SERVER_URL = "http://127.0.0.1:4096";
 function deriveHarnessSnapshot(signals) {
   const advertised = new Set(
     buildCompanionManifest({
-      // CT1082 + CT1379: connected AND the bundled binary the SDK launches is
-      // there — the manifest's own rule, restated here through the same function
-      // rather than re-decided. PATH is deliberately absent from both gates now.
+      // Connected AND the bundled binary present: the manifest's own rule. PATH
+      // is deliberately in neither gate.
       claudeCode: signals.claudeCodeConnected && signals.claudeBundled === "present",
       opencode: signals.opencodeConfigured,
       codex: signals.codexEnabled && signals.codexBundled === "present"
@@ -917,10 +878,8 @@ function deriveClaudeCode(signals, manifestHas) {
       ...base,
       state: "detected_not_exposed",
       version: signals.claudeVersion,
-      // CT1379: connecting records INTENT; it is not the same as becoming
-      // runnable. With the bundled binary missing, a connect succeeds and the
-      // device still advertises nothing — so this says so up front rather than
-      // promising routing it can't deliver.
+      // Connecting records INTENT, not runnability: with the bundled binary
+      // missing a connect succeeds and nothing is advertised, so say so.
       detail: signals.claudeBundled === "present" ? "Claude Code is installed here but not connected yet. Connect it to offer Claude Code from this device." : `Claude Code is installed here but not connected yet \u2014 and @cabane/companion's bundled Claude Code ${missingNoun(signals.claudeBundled)} is missing, so connecting alone won't make it runnable. ${repairAction()}`,
       enable: "claude-code"
     };
@@ -958,8 +917,7 @@ function deriveCodex(signals, manifestHas) {
       ...base,
       state: "detected_not_exposed",
       version: signals.codexVersion,
-      // CT1379: same distinction as Claude Code — enabling is intent, not
-      // launchability.
+      // As for Claude Code: enabling is intent, not launchability.
       detail: signals.codexBundled === "present" ? "Codex is installed but not enabled yet. Turn it on to offer Codex from this device." : `Codex is installed but not enabled yet \u2014 and @cabane/companion's bundled Codex ${missingNoun(signals.codexBundled)} is missing, so enabling alone won't make it runnable. ${repairAction()}`,
       enable: "codex"
     };
@@ -1040,12 +998,10 @@ async function probeHarnessSignals(cfg, deps = {}) {
   return {
     claudeOnPath: claudePresence.status === "present",
     claudeVersion,
-    // CT1082: the user's opt-in. Presence alone exposes nothing now, so this is
-    // the manifest gate and the probe above is only a suggestion.
+    // The user's opt-in, the manifest gate; the probe above only suggests.
     claudeCodeConnected: isClaudeCodeConnected(cfg),
-    // CT1379: the executable a Claude turn actually launches. Resolved every time
-    // the signals are, so a binary that disappears between beats is caught on the
-    // next one rather than at turn time.
+    // The executable a Claude turn launches, resolved with every probe so a
+    // binary that disappears is caught on the next beat, not at turn time.
     claudeBundled: resolveBundled("claude-code").status,
     codexBundled: resolveBundled("codex").status,
     // A parseable `codex --version` is our presence signal (presence alone never
@@ -1054,7 +1010,7 @@ async function probeHarnessSignals(cfg, deps = {}) {
     codexVersion,
     codexEnabled: isCodexEnabled(cfg),
     opencodeConfigured: !!configuredServerUrl,
-    // A version came back ⟺ the serve answered its health endpoint (CT584).
+    // A version came back ⟺ the serve answered its health endpoint.
     opencodeReachable: opencodeVersion !== null,
     opencodeVersion,
     opencodeDetectedUrl: opencodeVersion !== null ? opencodeProbeUrl : null
@@ -1320,7 +1276,7 @@ var CompanionStateHub = class {
   deviceId = null;
   deviceLabel = null;
   deviceError = null;
-  // CT586: the latest harness snapshot the supervisor probed, or null before the
+  // The latest harness snapshot the supervisor probed, or null before the
   // first probe (see CompanionStatusJson.harnesses).
   harnesses = null;
   // ---- subscription (SSE) ----
@@ -1347,7 +1303,7 @@ var CompanionStateHub = class {
     this.deviceError = null;
     this.emitStatus();
   }
-  // ---- harnesses (CT586) ----
+  // ---- harnesses ----
   // Replace the harness snapshot and push a status change (so the SSE feed flips
   // the Companion's Harnesses surface live). The supervisor calls this on each
   // heartbeat-cadence probe and on an on-demand recheck.
@@ -2292,7 +2248,7 @@ var LEASE_REFUSALS = /* @__PURE__ */ new Set([
   "dispatch_not_admitted",
   "turn_already_ended",
   "turn_belongs_elsewhere",
-  // Rooms: the context this start was composed from named an attempt the
+  // The context this start was composed from named an attempt the
   // lease no longer picks (midnight rolled it, a degrade retired it). Nothing
   // was granted; the turn recomposes its context and starts again, once.
   "dispatch_context_stale"
@@ -2390,10 +2346,8 @@ var CabaneApi = class {
     this.opts = opts;
   }
   opts;
-  // CT25: re-entrancy guard for `drainOutbox`. The supervisor kicks a drain
-  // from several places (startup, SSE reconnect, the backoff timer); without
-  // this guard two overlapping drains could each pick up the same queued entry
-  // and double-send it (the server dedupes, but the wasted POSTs aren't free).
+  // Re-entrancy guard for `drainOutbox`: drains are kicked from several places,
+  // and two overlapping ones would double-send the same entry.
   draining = false;
   lastDeliveryWarning = 0;
   get base() {
@@ -2455,19 +2409,13 @@ var CabaneApi = class {
       }
     }
   }
-  // CT25: send-or-enqueue for a turn-row commit. Tries the immediate
-  // (retry-budgeted) send first so the happy path keeps its current latency,
-  // then on a *retryable* failure persists the row to the on-disk outbox
-  // instead of dropping it. Classification is deliberate:
-  //   - success → done.
-  //   - no outbox configured (one-shot CLI / tests) → rethrow, exactly the
-  //     pre-CT25 behaviour.
-  //   - cancel (the turn was stopped; `signal` aborted or an AbortError) →
-  //     rethrow without queuing: the user asked us to stop, and the held text
-  //     was already dropped — we must not resurrect it from the queue.
-  //   - terminal 4xx (a deterministic rejection a replay can't fix) → rethrow,
-  //     so the caller's error path runs as it does today (e.g. the committer
-  //     re-arms its empty-final fallback).
+  // Send-or-enqueue for a turn-row commit: the immediate (retry-budgeted) send
+  // first, then on a *retryable* failure persist to the outbox.
+  //   - no outbox configured (one-shot CLI / tests) → rethrow.
+  //   - cancel (`signal` aborted or an AbortError) → rethrow without queuing:
+  //     the user asked us to stop, and the text must not resurrect from the queue.
+  //   - terminal 4xx (a replay can't fix it) → rethrow, so the caller's error
+  //     path runs.
   //   - retryable (transport / 5xx — commit outcome may be unknown) → queue
   //     and return. This acknowledges local delivery responsibility, not server
   //     persistence. Replays retain the endpoint's identity: messages/thinking/
@@ -2492,13 +2440,10 @@ var CabaneApi = class {
       );
     }
   }
-  // CT25: flush the outbox FIFO. Removes an entry once the server acknowledges
-  // it (2xx) or rejects it terminally (any 4xx — a deleted conversation 404, a
-  // forbidden, etc. — which a replay can never satisfy, so we discard with a
-  // log rather than spin forever). A retryable failure (transport / 5xx) means
-  // the API is still down: stop the cycle and leave that entry and the rest
-  // queued for the next drain. Returns a summary the supervisor's backoff
-  // scheduler reads. Re-entrancy-guarded so overlapping kicks don't double-send.
+  // Flush the outbox FIFO. An entry goes once the server acknowledges it (2xx)
+  // or rejects it terminally (any 4xx, which a replay can never satisfy: discard
+  // with a log rather than spin). A retryable failure means the API is still
+  // down: stop and leave that entry and the rest for the next drain.
   async drainOutbox() {
     const outbox = this.opts.outbox;
     if (!outbox) return { remaining: 0, progressed: false };
@@ -2546,40 +2491,24 @@ var CabaneApi = class {
     }
     return { remaining: outbox.size(), progressed };
   }
-  // CT25: how many commits are currently queued for this workspace — the
-  // supervisor's drain scheduler reads it to decide whether to keep polling.
+  // How many commits are queued; the drain scheduler reads it to decide whether
+  // to keep polling.
   outboxSize() {
     return this.opts.outbox?.size() ?? 0;
   }
-  // CT262: the ONE turn-context fetch. Collapses the companion's old four-fetch
-  // choreography (getConversation + getMessage + getAgentSelf + getParticipantAgent)
-  // into a single call: the server composes the whole server portion of the
-  // `TurnRequest` — systemPrompt, per-turn prompt + vision content, effective
-  // run-config, `HostPolicy`, prior session, the user MCP definitions to resolve
-  // locally, plus the anchor/title + trigger-message summary the host needs.
-  // Agent-PAT authed; the workspace is implied by the PAT.
-  // CT714: `turnId` is the host-minted id for THIS turn, passed so the server can
-  // bind the minted turn token to it — the turn-control surface then rejects a
-  // token whose turn has ended. The dispatcher mints it before this call and
-  // reuses the same value on its active-run PATCH, so the token's turn id and the
-  // pair's `active_turn_id` agree.
-  // CT1380: `resumed` says this dispatch is a REPLAY of an interrupted turn, so
-  // the server should hand back `turnSeqFloor` — the turn's committed seq
-  // high-water mark. Only the supervisor knows (it minted the id or recovered
-  // it), so it is passed down rather than inferred here. It gates the COST of
-  // the aggregate, never the tenancy scoping, which the route applies
-  // unconditionally.
-  // `fresh` asks for the context a session that holds NOTHING needs: the read
-  // from the start of the conversation, the agent's own words included, and
-  // the first-turn material — what the adapter runs on when it refused to
-  // resume the stored session and is starting a fresh one.
-  // CT1543: `episode` is the dispatch event's own, echoed back so the server can
-  // tell this frame from a later wake on the same message. Omitted when the
-  // event didn't carry one, which is the only thing an older event can mean.
-  // CT1657: `signal` is the turn's own abort. It matters here more than on any
-  // other read, because this call now waits up to ~8s across five attempts: a
-  // Stop landing in that window used to leave the whole schedule running, and
-  // the person watched a turn they had already stopped keep trying.
+  // The ONE turn-context fetch: the server composes the whole server portion of
+  // the `TurnRequest`. Agent-PAT authed; the workspace is implied by the PAT.
+  //   - `turnId`: the host-minted id the server binds the turn token to, so the
+  //     turn-control surface rejects a token whose turn has ended.
+  //   - `resumed`: a REPLAY of an interrupted turn, so the server returns
+  //     `turnSeqFloor`. Only the supervisor knows. It gates the cost of the
+  //     aggregate, never the tenancy scoping.
+  //   - `fresh`: the context a session holding NOTHING needs (the whole read,
+  //     own words included, plus first-turn material), for an adapter that
+  //     refused to resume the stored session.
+  //   - `episode`: the dispatch event's own, so the server can tell this frame
+  //     from a later wake on the same message. Omitted by an older event.
+  //   - `signal`: the turn's abort, so a Stop cuts the ~8s retry schedule short.
   getTurnContext(conversationId, messageId2, turnId, resumed, fresh, episode, signal) {
     const q = `conversationId=${encodeURIComponent(conversationId)}&messageId=${encodeURIComponent(messageId2)}` + (turnId ? `&turnId=${encodeURIComponent(turnId)}` : "") + (resumed ? "&resumed=1" : "") + (fresh ? "&fresh=1" : "") + (episode !== void 0 ? `&episode=${encodeURIComponent(String(episode))}` : "");
     return this.request("GET", `/api/agent/turn-context?${q}`, void 0, {
@@ -2587,9 +2516,8 @@ var CabaneApi = class {
       ...signal ? { signal } : {}
     });
   }
-  // CT1380: the local half of a resumed turn's seq floor (see
-  // `Outbox.maxSeqForTurn`). 0 when no outbox is configured — a one-shot CLI or
-  // test has no durable queue, so nothing can be hiding in it.
+  // The local half of a resumed turn's seq floor (`Outbox.maxSeqForTurn`). 0
+  // with no outbox: nothing can be hiding in a queue that doesn't exist.
   outboxMaxSeqForTurn(turnId) {
     return this.opts.outbox?.maxSeqForTurn(turnId) ?? 0;
   }
@@ -2605,13 +2533,11 @@ var CabaneApi = class {
       (e) => e.turnId === turnId && e.kind === "message" && e.body?.kind !== "runtime_notice"
     );
   }
-  // CT1677: ADOPT the issuance a turn context carried as the execution source of
-  // the work about to run on it. Made once per context, before preparation emits
-  // or queues anything, so every row that work commits can name a source the
-  // server has durably recorded and will never reap. Retried like any write: the
-  // server's adoption is idempotent. A 409 `execution_source_unavailable` is a
-  // refusal — nothing to adopt, the reaper got there first — and the caller
-  // fetches a fresh context rather than working on this one.
+  // ADOPT a turn context's issuance as the execution source of its work, once,
+  // before preparation emits or queues anything, so every row can name a source
+  // the server durably recorded and will never reap. Adoption is idempotent, so
+  // retried. A 409 `execution_source_unavailable` means the reaper got there
+  // first; the caller fetches a fresh context.
   adoptExecutionSource(issuanceId, body, signal) {
     return this.request(
       "POST",
@@ -2620,10 +2546,10 @@ var CabaneApi = class {
       signal ? { retry: true, signal } : { retry: true }
     );
   }
-  // CT1680: the launcher mints the runner credential for one dispatch, on its
-  // PAT and from its device, and hands it to the runner in place of both. A
-  // retry is safe: the server returns the same runner id and retires the
-  // credential the lost response carried.
+  // The launcher mints the runner credential for one dispatch, on its PAT and
+  // from its device, and hands it to the runner in place of both. A retry is
+  // safe: the server returns the same runner id and retires the credential the
+  // lost response carried.
   mintRunnerCredential(body) {
     return this.request("POST", "/api/agent/runner-credentials", body, { retry: true });
   }
@@ -2643,7 +2569,7 @@ var CabaneApi = class {
   // invocation. The server records the effect and receipt in one transaction;
   // an ok:false response is a recorded refusal for the tool to report.
   // Retries retain the caller's callId and recover the same receipt, even
-  // when the turn settled between attempts (CT1447): the route consults the
+  // when the turn settled between attempts: the route consults the
   // receipt before it refuses an ended turn, so a 4xx proves no attempt wrote.
   // The caller's signal bounds how long the model waits for the tool result.
   turnAct(workspaceId, turnId, act, signal) {
@@ -2654,36 +2580,23 @@ var CabaneApi = class {
       signal ? { retry: true, signal } : { retry: true }
     );
   }
-  // CT1292: RENEW THE TURN'S LEASE — ask the server whether this turn is still
-  // running. The dispatcher calls this on a cadence for the life of the SDK loop,
-  // and out of cadence the moment a commit is refused, so a loop whose turn was
-  // terminalized underneath it stops instead of running to the six-hour cap.
+  // RENEW THE TURN'S LEASE: is this turn still running? Called on a cadence for
+  // the life of the SDK loop and the moment a commit is refused, so a loop whose
+  // turn was terminalized underneath it stops.
   //
-  // Single-shot and NEVER retried, on purpose. A renewal is a question about
-  // right now, not a durable write: a failed one has no answer worth replaying,
-  // and the next tick asks again in a few seconds anyway. Retrying would only
-  // stretch one tick over the next one's slot.
+  // Single-shot, NEVER retried: a failed renewal has no answer worth replaying
+  // and the next tick asks again; retrying stretches one tick over the next.
   //
-  // ALL FAILURE IS `unknown`, and this is the safety property the whole feature
-  // rests on. The only thing that may stop a running loop is the server SAYING
-  // the turn is over; a 500, a dropped connection, an expired token or a body we
-  // cannot parse says nothing about the turn, and reading any of them as death
-  // would kill healthy turns every time the API hiccups — strictly worse than the
-  // gap this closes. So the failure direction is fixed here, at the boundary,
-  // rather than left to each caller to remember.
+  // ALL FAILURE IS `unknown`. Only the server SAYING the turn is over may stop a
+  // running loop; a 500, a dropped connection, an expired token or an
+  // unparseable body says nothing about the turn, and reading it as death would
+  // kill healthy turns on every API hiccup. Fixed here, at the boundary, so no
+  // caller has to remember.
   //
-  // AND IT IS DEADLINED (Codo's blocking finding #1). `fetch` has no default
-  // timeout, so a request that neither resolves nor rejects — a black-holed
-  // connection, a half-open socket surviving a network change — would hang this
-  // promise forever. That is not merely a slow probe: the caller single-flights
-  // on it, so one stalled request latches the check permanently, every later
-  // cadence tick returns immediately, and the loop this exists to stop runs to
-  // the six-hour cap even after connectivity comes back — the exact defect the
-  // task is about, reintroduced through the mechanism meant to close it.
-  //
-  // The deadline turns that into an ordinary `unknown`: the request rejects, the
-  // in-flight latch clears, and the NEXT tick asks again. Well under the renewal
-  // cadence so a stalled probe is finished with before its successor is due.
+  // DEADLINED, because `fetch` has no default timeout: a black-holed request
+  // would hang forever, and the caller single-flights on it, so one stall would
+  // latch the check and let the loop run to the cap. The deadline makes it an
+  // ordinary `unknown` and the next tick asks again.
   async checkTurnLease(workspaceId, conversationId, agentId, turnId) {
     const q = `turnId=${encodeURIComponent(turnId)}`;
     try {
@@ -2692,11 +2605,7 @@ var CabaneApi = class {
         `/api/workspaces/${workspaceId}/conversations/${conversationId}/participants/agents/${agentId}/turn-lease?${q}`,
         void 0,
         {
-          // CT1657: the one GET that opts OUT of the default retry. The reasoning
-          // is right above — a failed probe has no answer worth replaying and the
-          // next tick asks again in seconds, so retrying inside this one would
-          // stretch a tick over its successor's slot, which is what the deadline
-          // exists to prevent.
+          // The one GET that opts OUT of the default retry; see above.
           retry: false,
           signal: AbortSignal.timeout(this.opts.leaseCheckTimeoutMs ?? LEASE_CHECK_TIMEOUT_MS)
         }
@@ -2730,9 +2639,8 @@ var CabaneApi = class {
     }
     return this.request("PATCH", path, body);
   }
-  // CT93: send-or-enqueue for an active-run flag write, with last-writer-wins
-  // across the (conversation, agent) pair. Mirrors `durableCommit`, with two
-  // deliberate differences:
+  // Send-or-enqueue for an active-run flag write, last-writer-wins per
+  // (conversation, agent) pair. Like `durableCommit`, except:
   //   - No abort signal is threaded. The clear is the turn's teardown and must
   //     land even when the turn was *cancelled* (the abort signal is set) — a
   //     cancelled turn still has to drop its "working" indicator.
@@ -2786,9 +2694,6 @@ var CabaneApi = class {
       );
     }
   }
-  // CT29: per-device liveness moved off the per-workspace agent PAT and onto the
-  // device token — see `DeviceApi.heartbeat`. There is no agent-PAT heartbeat
-  // anymore.
   // Commit the agent's first/last words (message) or a runtime_notice through
   // the public messages endpoint. Intermediate working text uses reportText.
   // Attribution comes from the agent credential; a new speech row can offer
@@ -2937,7 +2842,7 @@ var DeviceApi = class {
       AbortSignal.timeout(5e3)
     );
   }
-  // CT1146: report that a dispatch addressed to THIS device can't be run, because
+  // Report that a dispatch addressed to THIS device can't be run, because
   // the agent isn't one this device runs (and still wasn't after a forced
   // assignments refresh). The server clears the Working flag, retires the dispatch
   // and posts an explanatory system message.
@@ -2951,7 +2856,7 @@ var DeviceApi = class {
     return this.request("POST", "/api/companion/dispatch-drop", body);
   }
   // Per-device liveness ping. Reports the companion build version and the env-var
-  // names the operator's secret store exposes (never values), so CT30's UI can
+  // names the operator's secret store exposes (never values), so the UI can
   // warn pre-emptively about an agent that needs a secret this device lacks.
   heartbeat(body) {
     return this.request("POST", "/api/companion/heartbeat", body ?? {});
@@ -3188,95 +3093,66 @@ var TURN_PROTOCOL_VERSION = 1;
 // packages/agent-runtime/src/host-policy.ts
 import { z as z5 } from "zod";
 var hostPolicySchema = z5.object({
-  // Host filesystem + shell: `Bash`/`Read`/`Write`/`Edit`/`Glob`/`Grep`, the
-  // notebook read/write pair, git-worktree tools, and the `REPL` host code-exec
-  // tool. Off under the locked assistant surface (today's `DISALLOWED_TOOLS`);
-  // on under `coding` mode.
+  // Host filesystem and shell: `Bash`/`Read`/`Write`/`Edit`/`Glob`/`Grep`, the notebook pair,
+  // git-worktree tools and `REPL`. Off on the locked assistant surface; on in the coding posture.
   hostFs: z5.boolean(),
-  // Public web (today's `WebSearch` / `WebFetch`, the `DEFAULT_WEB_TOOLS`). Public
-  // web, not host reach — granted by default today, but expressible as a grant.
+  // Public web (`WebSearch` / `WebFetch`). Not host reach; a grant like the rest.
   web: z5.boolean(),
-  // Browser automation (the Playwright MCP surface). Varies by host: a companion has
-  // it, the house executor does not (CT230).
+  // Browser automation (the Playwright MCP surface). Varies by host.
   browser: z5.boolean(),
-  // User-configured MCP servers permitted. False for the house executor
-  // (CT227: Cabane agents run no user MCP servers), true for a personal companion.
+  // User-configured MCP servers permitted.
   userMcp: z5.boolean(),
-  // Subagent / sub-dispatch (`Task` / `Agent`). A per-host GRANT (see the CT261
-  // amendment above): `false` on the locked assistant/house surface (banned via
-  // `DISALLOWED_TOOLS`), `true` under coding / custom where the fan-out is left to
-  // the coding allow-hook (which reaches sub-agent tool calls, CT680) or the user
-  // allowlist. The subagent completes within the turn, so
-  // it's not the turn-model invariant `scheduling` is.
+  // Subagent dispatch (`Task` / `Agent`) — a grant: `false` on the locked surface, `true` in the
+  // coding posture, where the coding allow-hook reaches sub-agent tool calls. A subagent completes
+  // within the turn, so it's not an invariant like `scheduling`.
   subagents: z5.boolean(),
   // ── Hard platform invariants — always denied, never granted ────────────────
-  // Deferred re-invocation / scheduling (`ScheduleWakeup`, the `Cron*` / `Task*`
-  // families, `Monitor`, `Workflow`, …). A turn is one query that resolves when
-  // `result` fires; a scheduled callback fires after the reply window has closed
-  // and strands the agent (the CT155/CT156 rule).
+  // Deferred re-invocation / scheduling (`ScheduleWakeup`, the `Cron*` / `Task*` families,
+  // `Monitor`, `Workflow`, …). A turn is one query that resolves on `result`; a scheduled callback
+  // fires after the reply window has closed and strands the agent.
   scheduling: z5.literal("never"),
-  // Human-facing UI prompts (`AskUserQuestion`). A Cabane conversation has no
-  // handler to answer a structured prompt, so the call hangs the turn
-  // (`UNSUPPORTED_TOOLS`). The agent asks in its reply instead.
+  // Human-facing UI prompts (`AskUserQuestion`). Nothing in a Cabane conversation can answer a
+  // structured prompt, so the call hangs the turn. The agent asks in its reply instead.
   uiPrompts: z5.literal("never")
 });
 
 // packages/agent-runtime/src/turn-event.ts
 import { z as z6 } from "zod";
 var turnEventSchema = z6.discriminatedUnion("type", [
-  // The runtime's opaque session state, emitted when the adapter learns it (e.g.
-  // the SDK `system/init` frame). The platform stores `state` verbatim per
-  // (conversation, agent) and hands it back on the next turn; only the adapter
-  // knows what it means. Today's companion captures the raw SDK session id here; a
-  // future adapter may encode more (e.g. `{sdkSessionId, cwd}`) — still one
-  // opaque string to the platform.
+  // The runtime's opaque session state, emitted when the adapter learns it (e.g. the SDK
+  // `system/init` frame). The platform stores `state` verbatim per (conversation, agent) and
+  // hands it back next turn; only the adapter knows what it means.
   //
-  // CT315: `degraded: true` means the adapter started this FRESH session despite
-  // a stored one it was handed — a cwd/directory mismatch (the SJ527 guard) or
-  // legacy/foreign state it refused to resume. It is NOT set for a genuine
-  // first turn (`no_session`). The signal matters because the server built this
-  // turn's catch-up manifest assuming the prior session carried everything up to
-  // the high-water mark (CT298's two-channel invariant); a degrade breaks that,
-  // so the mark now over-reaches an empty session. The host relays `degraded`
-  // on settle and the server rewinds the mark, so the NEXT turn rebuilds a full
-  // catch-up (this failing turn is unavoidably lossy — the degrade is only known
-  // on the companion, after the server committed the manifest). Runtime-neutral: a
-  // plain boolean, not a runtime-specific reason string (that stays in the
-  // adapter's `onWarn` log). Additive + optional — an old receiver ignores it.
+  // `degraded: true`: the adapter started this fresh session despite a stored one (a cwd
+  // mismatch, or legacy/foreign state it refused to resume) — never for a genuine first turn.
+  // The server built this turn's catch-up manifest assuming the prior session held everything up
+  // to the high-water mark; a degrade breaks that. The host relays `degraded` on settle and the
+  // server rewinds the mark, so the next turn rebuilds a full catch-up (this turn is unavoidably
+  // lossy — the degrade is known only after the manifest was committed). A plain boolean; the
+  // runtime-specific reason stays in the adapter's `onWarn` log. Optional.
   z6.object({
     type: z6.literal("session"),
     state: z6.string(),
     degraded: z6.boolean().optional()
   }),
-  // One readable thinking summary. Maps `onThinking({ text })`. Transient —
-  // surfaced live, never persisted as durable content.
+  // One readable thinking summary. Transient — surfaced live, never persisted as content.
   z6.object({ type: z6.literal("thinking"), text: z6.string() }),
-  // Assistant text. Maps `onAssistantText({ text, final })` — `text`→`body`,
-  // `final`→`terminal`. `terminal: false` is interim narration (commits as a
-  // `progress` row); `terminal: true` is the turn's closing reply (commits as
-  // the `final` row).
+  // Assistant text. `terminal: false` is interim narration (commits as `progress`);
+  // `terminal: true` is the turn's closing reply (commits as `final`).
   z6.object({ type: z6.literal("text"), body: z6.string(), terminal: z6.boolean() }),
-  // Runtime/provider-authored prose about the turn — a failure's explanation, or
-  // a line the harness wrote on a turn it recovered (CT1750). Unlike
-  // `text`, this is not the agent's narration or reply: the pump persists it as
-  // `runtime_notice`, and the transcript renders it in the shared SystemNote
-  // voice. Adapters emit it only from positive runtime evidence; the web never
-  // classifies English strings.
+  // Runtime/provider-authored prose about the turn — a failure's explanation, or a line the
+  // harness wrote on a turn it recovered. Not the agent's words: the pump persists it as
+  // `runtime_notice`, drawn in the SystemNote voice. Adapters emit it only from positive runtime
+  // evidence; the web never classifies English strings.
   z6.object({ type: z6.literal("runtime_notice"), body: z6.string() }),
-  // A tool-activity transition. Maps `onToolActivity` — `toolUseId`→`id`,
-  // `toolName`→`name` (already prefix-stripped: `cabane_read`, not
-  // `mcp__cabane__cabane_read`), `summary` is the short card label. `phase`
-  // pairs `start` with a later `done`/`error` on the same `id`.
+  // A tool-activity transition. `name` is prefix-stripped (`cabane_read`, not
+  // `mcp__cabane__cabane_read`); `summary` is the short card label; `phase` pairs `start` with a
+  // later `done`/`error` on the same `id`.
   //
-  // `input`/`result` are typed `unknown` (the raw tool payloads), widening
-  // today's already-truncated `input: string` / `result: string` — see
-  // docs/turn-protocol.md: rendering/truncation for the tool log is a
-  // pump/consumer concern applied to the value, not baked into the event type.
-  // CT496: `mcpServer` is the MCP server the call came from (`cabane`,
-  // `playwright`, …), derived off the raw `mcp__<server>__` name before `name`
-  // dropped the prefix; null for a host / built-in tool. The client tags Cabane
-  // MCP calls (`=== 'cabane'`) with a subtle glyph. Nullable + optional so a
-  // pre-CT496 producer that never sets it is unaffected (treated as null).
+  // `input`/`result` are `unknown` (the raw tool payloads): rendering and truncation for the tool
+  // log are a consumer concern (docs/turn-protocol.md). `mcpServer` is the MCP server the call
+  // came from (`cabane`, `playwright`, …), derived before `name` dropped the prefix; null for a
+  // host tool. Optional, read as null when absent.
   z6.object({
     type: z6.literal("tool"),
     id: z6.string(),
@@ -3287,45 +3163,25 @@ var turnEventSchema = z6.discriminatedUnion("type", [
     result: z6.unknown().optional(),
     mcpServer: z6.string().nullable().optional()
   }),
-  // The turn's terminal outcome. Maps the `{ ok, reason }` both loops return
-  // inline. `ok:false` carries a machine reason (`no_session`, an error code);
-  // the host's clear-PATCH surfaces it as `errorReason`.
-  //
-  // CT277: an optional `usage` — the SDK result's token counts, which were
-  // dropped on the floor before. `inputTokens` is the full context the model saw
-  // (uncached + cache-read + cache-creation input), so it doubles as the
-  // context-window cost; `outputTokens` the generated tokens. Optional ⇒
-  // backward-compatible: an old companion / adapter that never sets it, and a
-  // receiver that never reads it, are unaffected (the turn's token columns stay
-  // null → the UI shows `—`).
+  // The turn's terminal outcome. `ok:false` carries a machine reason (`no_session`, an error
+  // code), surfaced by the host's clear-PATCH as `errorReason`.
   //
-  // CT597: two optional cache-token counts — the slice of `inputTokens` that was
-  // a cache read vs. a cache creation, when the runtime breaks it out (claude-code
-  // does). Additive + optional: a runtime that doesn't report them omits them, and
-  // the server just leaves the cache columns null. Captured now because honest
-  // costing later prices a cache-read token far below a fresh input token.
+  // `usage`: the SDK result's token counts. `inputTokens` is the full context the model saw
+  // (uncached + cache-read + cache-creation). The cache counts, when the runtime breaks them out,
+  // are a subset of it, kept because a cache-read token costs far less. All optional; absent
+  // leaves the columns null and the UI shows `—`.
   //
-  // CT699: `inputTokens` (and the cache slice) is a BILLING quantity — for
-  // claude-code/codex it's the runtime's CUMULATIVE total summed across every model
-  // request in the agentic turn, so it grows with the tool-call count and is NOT
-  // "how full is the window." `contextTokens` is the distinct CONTEXT-OCCUPANCY
-  // read and `contextWindow` the window it is measured against, both as the
-  // harness reported them (claude-code's `getContextUsage`, or its final
-  // request's input and `modelUsage` window when that call gives nothing). A
-  // runtime that can't source them (codex's cumulative-only usage) omits both,
-  // and no surface shows a reading for that turn.
+  // `inputTokens` is a billing quantity — for claude-code/codex the cumulative total across every
+  // model request in the turn, growing with tool calls, not "how full is the window".
+  // `contextTokens` is the occupancy read and `contextWindow` its window, as the harness reported
+  // them (claude-code's `getContextUsage`, else its final request's input and `modelUsage`
+  // window). A runtime that can't source them (codex) omits both.
   //
-  // CT601: two more optional carry-homes on the terminal result, alongside
-  // `usage`. `resolvedModel` is the CONCRETE model the runtime actually ran —
-  // claude-code learns it from the `system/init` frame mid-run (even for a
-  // subscription-default token, where the configured model is null), codex records
-  // the model the thread was started with. `resolvedConfig` is the resolved
-  // per-runtime knobs the harness reported (`{ reasoningEffort }` for codex; none
-  // for claude-code today). Both only known after the run streams — so they ride
-  // the terminal event home, the host relays them on settle, and the server writes
-  // `message_turn_metadata.resolved_model` / `resolved_config`. Optional ⇒
-  // backward-compatible: an old adapter/companion omits them, a cancel has no result
-  // event at all, and the columns stay null → the UI shows `—`.
+  // `resolvedModel` is the concrete model the runtime ran (claude-code learns it from
+  // `system/init` mid-run, even for a subscription default; codex records the model the thread
+  // started with); `resolvedConfig` the knobs the harness reported (`{ reasoningEffort }` for
+  // codex). Known only after the run streams, so they ride this event home and the host relays
+  // them on settle. A cancel has no result event at all.
   z6.object({
     type: z6.literal("result"),
     ok: z6.boolean(),
@@ -3337,9 +3193,8 @@ var turnEventSchema = z6.discriminatedUnion("type", [
       cacheCreationTokens: z6.number().optional(),
       contextTokens: z6.number().optional(),
       contextWindow: z6.number().optional(),
-      // CT1751: the rest of the harness's own context reading, when it gave
-      // one: where it will compact, its `/context` breakdown, and every
-      // compaction it reported during the turn. Claude Code only.
+      // The rest of the harness's context reading, when it gave one: where it will compact, its
+      // `/context` breakdown, and every compaction it reported. Claude Code only.
       contextCompactAt: z6.number().optional(),
       contextCategories: z6.array(
         z6.object({
@@ -3362,10 +3217,9 @@ var turnEventSchema = z6.discriminatedUnion("type", [
       thinking: z6.string().optional(),
       reasoningEffort: z6.string().optional()
     }).optional(),
-    // CT1275: the harness-reported MCP inventory from this turn's init frame.
-    // This is deliberately diagnostic-only: names, statuses and a count, never
-    // server definitions, credentials or session ids. `initReceived:false`
-    // distinguishes a missing init frame from a real empty inventory.
+    // The harness-reported MCP inventory from this turn's init frame. Diagnostic only: names,
+    // statuses and a count — never server definitions, credentials or session ids.
+    // `initReceived:false` tells a missing init frame from a real empty inventory.
     mcpInventory: z6.object({
       initReceived: z6.boolean(),
       servers: z6.array(z6.object({ name: z6.string(), status: z6.string() })),
@@ -3468,9 +3322,8 @@ function isContentBearingEvent(event) {
       return normalizeCommitText(event.text) !== "";
     case "tool":
       return true;
-    // CT1750: a runtime notice is shown, but it is the harness speaking about
-    // the turn, not the turn's output — a success whose only output is a CLI
-    // line still produced nothing.
+    // A runtime notice is shown, but it is the harness speaking about the turn, not its output — a
+    // success whose only output is a CLI line still produced nothing.
     case "runtime_notice":
     case "session":
     case "result":
@@ -3542,11 +3395,10 @@ var turnRequestSchema = z8.object({
     mcpUrl: z8.string(),
     bearer: z8.string(),
     activeConversationId: z8.string(),
-    // Scoped turn-control MCP URL. Codex/opencode mount it as cabane_companion
-    // with the bearer and active-conversation header. It supplies ask,
-    // withdraw_ask, wake_me, cancel_wake and skip_turn. Claude Code mounts the
-    // companion's in-process instance instead. Optional for compatibility;
-    // the companion populates it in build-options.ts.
+    // Scoped turn-control MCP URL. Codex and opencode mount it as `cabane_companion` with the bearer
+    // and active-conversation header, for ask, withdraw_ask, wake_me, cancel_wake and skip_turn.
+    // Claude Code mounts the companion's in-process instance instead. Optional; the companion
+    // populates it.
     turnControlUrl: z8.string().optional(),
     // Workspace coordinate retained for envelope compatibility. Current
     // adapters use MCP, whose workspace operations take workspaceId explicitly.
@@ -3559,19 +3411,17 @@ var turnRequestSchema = z8.object({
     cwd: z8.string().optional(),
     env: z8.record(z8.string(), z8.string()).optional(),
     mcpServers: resolvedMcpServersSchema.optional(),
-    // CT1698: the values `headersFromEnv` names, per turn (`CABANE_MCP_<n>` →
-    // complete header value). The adapter merges them into the harness
-    // process's environment and nowhere else; the host never merges them into
-    // its own. Absent when no server references one.
+    // The values `headersFromEnv` names, per turn (`CABANE_MCP_<n>` → complete header value). The
+    // adapter merges them into the harness process's environment and nowhere else; the host never
+    // merges them into its own. Absent when no server references one.
     secretEnv: z8.record(z8.string(), z8.string()).optional(),
-    // CT289: machine-local claude-code adapter knobs the operator sets on a
-    // companion they run themselves — the auto-memory escape hatch. `autoMemory:
-    // true` opts back into Claude Code's auto-memory (governed by the operator's
-    // own `.claude/settings.json`); absent/false leaves the adapter's force-off
-    // default in place (see `buildClaudeCodeOptions`).
+    // Machine-local claude-code knobs for an operator running their own companion — the auto-memory
+    // escape hatch. `autoMemory: true` opts back into Claude Code's auto-memory (governed by the
+    // operator's `.claude/settings.json`); absent/false keeps the adapter's force-off default
+    // (`buildClaudeCodeOptions`).
     claudeCode: z8.object({ autoMemory: z8.boolean().optional() }).optional()
   }),
-  // Host-owned injected servers (host-filled) — e.g. the send server.
+  // Host-owned injected servers (host-filled).
   extra: z8.object({
     mcpServers: hostInjectedServersSchema
   })
@@ -3649,8 +3499,8 @@ async function emitToolResults(msg, emit, pending, onError) {
         // result payload off the block.
         input: started?.input,
         result: block.content,
-        // CT496: carry the server captured at `start` (the pretty name here has
-        // already lost its prefix). Null when the start wasn't seen.
+        // The server captured at `start` (the pretty name here has lost its prefix). Null when the
+        // start wasn't seen.
         mcpServer: started?.mcpServer ?? null
       },
       onError
@@ -3719,24 +3569,18 @@ function summarizeToolInput(input) {
   return "";
 }
 var TOOL_IO_MAX_CHARS = 1e4;
-function summarizeToolIo(input) {
+function renderToolIo(input) {
   if (input === void 0 || input === null) return "";
-  if (typeof input === "string") {
-    const trimmed = input.trim();
-    return trimmed.length > 0 ? truncate(trimmed, TOOL_IO_MAX_CHARS) : "";
-  }
+  if (typeof input === "string") return input.trim();
   try {
-    return truncate(JSON.stringify(input), TOOL_IO_MAX_CHARS);
+    return JSON.stringify(input) ?? "";
   } catch {
     return "";
   }
 }
-function summarizeToolResult(content) {
+function renderToolResult(content) {
   if (content === void 0 || content === null) return "";
-  if (typeof content === "string") {
-    const trimmed = content.trim();
-    return trimmed.length > 0 ? truncate(trimmed, TOOL_IO_MAX_CHARS) : "";
-  }
+  if (typeof content === "string") return content.trim();
   if (Array.isArray(content)) {
     const parts = [];
     let sawContentEntry = false;
@@ -3751,12 +3595,12 @@ function summarizeToolResult(content) {
       }
     }
     const joined = parts.join("\n").trim();
-    if (joined.length > 0) return truncate(joined, TOOL_IO_MAX_CHARS);
+    if (joined.length > 0) return joined;
     if (sawContentEntry || content.length === 0) return "";
   }
   if (typeof content !== "object") return "";
   if (!Array.isArray(content) && Object.keys(content).length === 0) return "";
-  return summarizeToolIo(content);
+  return renderToolIo(content);
 }
 function truncate(s, max) {
   if (s.length <= max) return s;
@@ -3773,15 +3617,19 @@ function sinkEmitter(sink, _onError) {
         return;
       case "tool":
         if (sink.onToolActivity) {
+          const input = renderToolIo(event.input);
+          const result = event.result === void 0 ? null : renderToolResult(event.result);
           await sink.onToolActivity({
             toolUseId: event.id,
             toolName: event.name,
             summary: event.summary,
-            // SJ529: render the raw payloads for the tool log here — the single
-            // truncation site (CT255 consumer concern).
-            input: summarizeToolIo(event.input),
-            result: event.result === void 0 ? "" : summarizeToolResult(event.result),
-            // CT496: carry the originating MCP server (null when absent / a host tool).
+            input: truncate(input, TOOL_IO_MAX_CHARS),
+            result: result === null ? "" : truncate(result, TOOL_IO_MAX_CHARS),
+            // Only when the event carried an input: a completion whose start this process never saw has
+            // none, and a zero would overwrite the size its start recorded.
+            ...event.input === void 0 ? {} : { inputChars: input.length },
+            ...result === null ? {} : { resultChars: result.length },
+            // The originating MCP server (null when absent / a host tool).
             mcpServer: event.mcpServer ?? null,
             phase: event.phase
           });
@@ -3841,6 +3689,8 @@ var TurnPump = class {
           summary: evt.summary,
           input: evt.input,
           result: evt.result,
+          ...evt.inputChars !== void 0 ? { inputChars: evt.inputChars } : {},
+          ...evt.resultChars !== void 0 ? { resultChars: evt.resultChars } : {},
           mcpServer: evt.mcpServer,
           phase: evt.phase,
           seq
@@ -3873,22 +3723,18 @@ var TurnPump = class {
   // The turn's final reply text, captured for the dashboard feed / logging.
   finalReplyBody = null;
   emittedFinalSource = "none";
-  // CT1383: provider tool id → the persisted identity of its CURRENT call. The
-  // provider's id is only a lookup key: it is unique within one adapter
-  // invocation at best (Codex restarts at `item_0` on every invocation, and a
-  // resumed turn keeps its turn id), so the row and the outbox entry are keyed
-  // on what the pump mints — a host id for the host's `(turn_id, tool_use_id)`
-  // upsert, and a seq for the outbox's `(turnId, seq)` file. Both are minted
-  // together; minting only the id would let two calls overwrite each other's
-  // queued body.
+  // Provider tool id → the persisted identity of its current call. The provider's id is only a
+  // lookup key, unique within one adapter invocation at best (Codex restarts at `item_0` every
+  // invocation, and a resumed turn keeps its turn id), so the row and the outbox entry are keyed on
+  // what the pump mints: a host id for the host's `(turn_id, tool_use_id)` upsert, and a seq for the
+  // outbox's `(turnId, seq)` file. Minted together; minting only the id would let two calls
+  // overwrite each other's queued body.
   //
-  // In memory on purpose: it dies with the process, and so does the runtime.
-  // After a crash no in-flight `done` awaits a pre-crash `start` — the resumed
-  // invocation starts its calls afresh — so there is nothing to recover.
+  // In memory on purpose: it dies with the process, and so does the runtime. After a crash no
+  // in-flight `done` awaits a pre-crash `start` — the resumed invocation starts its calls afresh.
   toolCallByProviderId = /* @__PURE__ */ new Map();
-  // The callback consumer the classification (via `sinkEmitter`) — and the
-  // frozen committer test — drive. Each callback applies the choreography and
-  // commits through the injected sink.
+  // The callback consumer the classification (via `sinkEmitter`) and the committer test drive.
+  // Each callback applies the choreography and commits through the injected sink.
   sink;
   // Whether a message has landed under this span — first words, at least. A
   // span that spoke settles; one that never did is a pass.
@@ -3980,7 +3826,7 @@ var TURN_CONTROL_FIELD_DESCRIPTIONS = {
   wake_me: {
     afterSeconds: "Relative delay in seconds from NOW \u2014 this call (e.g. 300 = five minutes). Provide EITHER this or `at`, not both. Floor 60s, horizon 14 days \u2014 enforced server-side.",
     at: "Absolute ISO-8601 timestamp WITH a zone (`Z` or `\xB1HH:MM`), e.g. `2026-07-16T09:00:00-07:00`. YOU compute it from a natural-language phrase using the current datetime in your turn context. Provide EITHER this or `afterSeconds`, not both.",
-    note: `A note to your future self \u2014 becomes the body of the wake message that re-dispatches you, up to ${MAX_WAKE_NOTE_BYTES} characters. Write the condition to re-check ("check whether the PR merged").`
+    note: `A note to your future self \u2014 becomes the body of the wake message that re-dispatches you, up to ${MAX_WAKE_NOTE_BYTES} characters. Write the condition to re-check in a sentence or two ("check whether the PR merged"), not a plan. You never need to name yourself: the wake reaches you on its own.`
   },
   withdraw_ask: {
     askId: "The open ask to withdraw. Ask ids ride the conversation's message rows (`ask: { id, status, items }`), and your turn context lists the ones you have open.",
@@ -3993,7 +3839,7 @@ var MEANINGS = {
   ask: "put a structured question to a person",
   cancel_wake: "cancel your own armed wake in this conversation",
   skip_turn: "end without posting a reply",
-  wake_me: "schedule your own return",
+  wake_me: "schedule your own return; when it fires, say first what you came back to check",
   withdraw_ask: "withdraw an open ask in this conversation with a reason"
 };
 function turnControlPromptGuidance(prefix) {
@@ -4214,52 +4060,41 @@ function buildClaudeCodeOptions(req, augment) {
     // pinned `model` arrives as a bare SDK id — the host already resolved the
     // namespaced catalog id to it.
     ...model ? { model } : {},
-    // SJ530: surface thinking summaries — default adaptive+summarized, and fill in
-    // `display:'summarized'` on a configured adaptive/enabled block that omits one.
-    // Read from the adapter's own dialect slice (`runtimeOptions['claude-code']`).
+    // Surface thinking summaries: default adaptive+summarized, and fill in `display:'summarized'`
+    // on a configured adaptive/enabled block that omits one. Read from the adapter's dialect slice
+    // (`runtimeOptions['claude-code']`).
     thinking: withThinkingSummaries(readThinking(config.runtimeOptions)),
     ...config.effort ? { effort: config.effort } : {},
     // Never merge arbitrary user `~/.claude` config; without `strictMcpConfig` the
     // user's existing `cabane` MCP registration could shadow ours.
     settingSources: [],
     strictMcpConfig: true,
-    // CT289: force auto-memory off unless the operator opted back in (see above).
+    // Auto-memory off unless the operator opted back in (see above).
     ...devControlsAutoMemory ? {} : { settings: { autoMemoryEnabled: false } },
     mcpServers,
     ...cwd ? { cwd } : {},
-    // Extra env (a companion prepare hook's tokens/ports; the in-app's debug flags)
-    // merged OVER the inherited environment.
+    // Extra env (a companion prepare hook's tokens/ports) merged over the inherited environment.
     //
-    // CT1503: and the background-tasks kill switch LAST, so nothing in
-    // `process.env` or `req.local.env` can turn it back on. Claude Code converts
-    // a foreground command that hits its Bash ceiling (600 000 ms) into a
-    // background task instead of erroring; the agent then reads a phantom task
-    // id inside a live turn. A later turn that resumed such a session was then
-    // seen getting every tool call aborted with kind `background` — which the CLI
-    // renders as "The user doesn't want to take this action right now", a
-    // cancellation wearing a refusal's words. The automatic conversion is
-    // REPRODUCED and is what this flag fixes; that the stopped task is what
-    // poisoned the resumed session is an INFERENCE from one incident, consistent
-    // with the transcript but never reproduced, and this change does not rest on
-    // it. `Dl()` reads this variable on the Bash tool's own call
-    // path and sets `canAutoBackground: false` and `turnAbortBackgrounds: false`
-    // together, so a timed-out command comes back as a readable error instead.
+    // The background-tasks kill switch goes last, so nothing in `process.env` or `req.local.env`
+    // turns it back on. Claude Code converts a foreground command that hits its Bash ceiling
+    // (600 000 ms) into a background task instead of erroring, and the agent then holds a phantom
+    // task id inside a live turn; a resumed session was seen with every tool call aborted as
+    // `background` ("The user doesn't want to take this action right now"). The conversion is
+    // reproduced and fixed by this flag; that it poisoned the resumed session is an inference
+    // from one incident, and this change doesn't rest on it. `Dl()` reads the variable on the
+    // Bash tool's call path and sets `canAutoBackground: false` and `turnAbortBackgrounds: false`,
+    // so a timed-out command returns a readable error.
     //
-    // The cost is acknowledged and deliberate: it ALSO removes deliberate
-    // `run_in_background` (the parameter leaves the tool schema). That is the
-    // only switch this harness offers, and there is no operator opt-out here on
-    // purpose — an escape hatch would contradict the guarantee. It is a targeted
-    // mitigation for the automatic conversion, NOT a cleanup mechanism: step 0
-    // measured that this flag changes no process-survival outcome on any turn-end
-    // path. Cleanup is its own change.
+    // The cost is deliberate: it also removes `run_in_background` (the parameter leaves the tool
+    // schema). It is the only switch, and there is no opt-out — an escape hatch would contradict
+    // the guarantee. It changes no process-survival outcome on any turn-end path (measured);
+    // cleanup is a separate concern.
     //
-    // Note `env` REPLACES the subprocess environment rather than merging (the
-    // SDK's own doc on `Options.env`), which is why `process.env` is spread here
-    // and why this key is now always present — previously it appeared only when
-    // `req.local.env` was set, and an absent `env` inherits `process.env`.
+    // `env` replaces the subprocess environment rather than merging (`Options.env`), which is why
+    // `process.env` is spread here and the key is always present.
     //
-    // CT1698: `secretEnv` joins here, and only here — the values the MCP
-    // headers above reference. It is this child's environment, not the host's.
+    // `secretEnv` — the values the MCP headers above reference — joins here and only here: it is
+    // this child's environment, not the host's.
     env: {
       ...process.env,
       ...req.local.env,
@@ -4750,8 +4585,7 @@ function makeRequest(overrides2 = {}) {
     systemPrompt: "system",
     prompt: "hi there",
     content: [{ type: "text", text: "hi there" }],
-    // CT302: model is required — the adapter rejects a null model, so the
-    // conformance fixture carries a real bare SDK id.
+    // The adapter rejects a null model, so the fixture carries a real bare SDK id.
     config: { model: "claude-opus-4-8" },
     policy: CABANE_POLICY,
     session: null,
@@ -4864,7 +4698,7 @@ var BASE_CLAUDE_CODE_CONFORMANCE_FIXTURES = [
         phase: "start",
         summary: "sleep.md",
         input: { path: "sleep.md" },
-        // CT496: derived off the raw `mcp__cabane__` name.
+        // Derived from the raw `mcp__cabane__` name.
         mcpServer: "cabane"
       },
       {
@@ -4882,9 +4716,9 @@ var BASE_CLAUDE_CODE_CONFORMANCE_FIXTURES = [
     ]
   },
   {
-    // HIGHEST-RISK: cancel mid-stream. The abort lands after the tool result;
-    // the adapter stops before the closing reply — no final text, no `result`
-    // event. CT1295: the server writes the `kind:'stopped'` marker.
+    // Highest risk: cancel mid-stream. The abort lands after the tool result; the adapter stops
+    // before the closing reply — no final text, no `result` event (the server writes the stopped
+    // marker).
     name: "cancel mid-stream",
     request: makeRequest(),
     nativeStream: [
@@ -4936,12 +4770,9 @@ var BASE_CLAUDE_CODE_CONFORMANCE_FIXTURES = [
     ]
   },
   {
-    // CT1144: the empty-runtime anomaly's exact captured trace — `system/init`
-    // then a successful `result`, with nothing in between. Distinct from
-    // `empty-final` below: THAT turn did work (a tool ran) and just didn't speak;
-    // this one produced nothing at all. The adapter's job is unchanged either way
-    // — report faithfully what the runtime said — so it must still emit
-    // `result{ok:true}` here; the host is what decides that a success with no
+    // The empty-runtime anomaly's captured trace: `system/init` then a successful `result`, nothing
+    // in between. Distinct from `empty-final` (a tool ran, no speech); this produced nothing. The
+    // adapter reports faithfully — `result{ok:true}` — and the host decides that a success with no
     // content-bearing event is a failed turn.
     name: "zero-content success (empty runtime result)",
     request: makeRequest(),
@@ -4949,9 +4780,9 @@ var BASE_CLAUDE_CODE_CONFORMANCE_FIXTURES = [
     expected: [sessionEvent("s1"), { type: "result", ok: true }]
   },
   {
-    // CT1220: on resume, a completed background task can emit a notification and
-    // its own zero-token result before the prompt's frames. That result is not the
-    // turn boundary; decoding continues through the prompt's reply and real usage.
+    // On resume, a completed background task can emit a notification and its own zero-token result
+    // before the prompt's frames. That result is not the turn boundary; decoding continues through
+    // the reply and real usage.
     name: "task-notification result does not end a resumed turn",
     request: makeRequest({ session: encodeSession({ sdkSessionId: "s1", cwd: CWD }) }),
     nativeStream: [
@@ -5027,8 +4858,8 @@ var BASE_CLAUDE_CODE_CONFORMANCE_FIXTURES = [
     ]
   },
   {
-    // CT1220: the filter is deliberately narrow. An origin-less zero-token result
-    // keeps today's break-on-first-result behavior, even if more frames follow.
+    // The filter is deliberately narrow: an origin-less zero-token result still ends the turn, even
+    // if more frames follow.
     name: "origin-less result still ends a resumed turn",
     request: makeRequest({ session: encodeSession({ sdkSessionId: "s1", cwd: CWD }) }),
     nativeStream: [
@@ -5099,11 +4930,10 @@ var BASE_CLAUDE_CODE_CONFORMANCE_FIXTURES = [
     ]
   },
   {
-    // CT558/CT592/CT731: a subscription cap. The SDK emits a rejected
-    // `rate_limit_event` with a named subscription window; the terminal error result
-    // then classifies as the structured `usage_capped` reason. The held provider
-    // line independently classifies to the same kind, so it lands as a runtime
-    // notice rather than agent-authored progress.
+    // A subscription cap. The SDK emits a rejected `rate_limit_event` with a named subscription
+    // window; the terminal error result classifies as `usage_capped`. The held provider line
+    // independently classifies to the same kind, so it lands as a runtime notice, not agent
+    // progress.
     name: "subscription cap \u2192 usage_capped",
     request: makeRequest(),
     nativeStream: [
@@ -5122,9 +4952,8 @@ var BASE_CLAUDE_CODE_CONFORMANCE_FIXTURES = [
     ]
   },
   {
-    // CT1336: a failed turn can still contain the agent's own partial narration.
-    // No text classification means no authorship rewrite, even though the
-    // structured result is the same usage cap.
+    // A failed turn can still contain the agent's own partial narration. No text classification
+    // means no authorship rewrite, even though the structured result is the same usage cap.
     name: "partial narration before subscription cap stays progress",
     request: makeRequest(),
     nativeStream: [
@@ -5140,8 +4969,8 @@ var BASE_CLAUDE_CODE_CONFORMANCE_FIXTURES = [
     ]
   },
   {
-    // CT1336: even recognized runtime prose stays authored when its kind
-    // disagrees with the structured terminal failure.
+    // Recognized runtime prose stays authored when its kind disagrees with the structured terminal
+    // failure.
     name: "cap notice before server failure stays progress",
     request: makeRequest(),
     nativeStream: [
@@ -5163,10 +4992,9 @@ var BASE_CLAUDE_CODE_CONFORMANCE_FIXTURES = [
     ]
   },
   {
-    // CT1336 review: `classifyErrorText` intentionally searches arbitrary error
-    // blobs for status tokens. Assistant narration needs the stricter whole-
-    // notice classifier, or an incidental count is de-authored when the turn
-    // later fails with the matching provider kind.
+    // `classifyErrorText` deliberately searches arbitrary error blobs for status tokens. Assistant
+    // narration needs the stricter whole-notice classifier, or an incidental count would be
+    // de-authored when the turn later fails with the matching provider kind.
     name: "incidental 5xx-shaped narration before server failure stays progress",
     request: makeRequest(),
     nativeStream: [
@@ -5188,9 +5016,8 @@ var BASE_CLAUDE_CODE_CONFORMANCE_FIXTURES = [
     ]
   },
   {
-    // CT558/CT592: a cap signalled only by the result's
-    // `terminal_reason:'blocking_limit'` (no discrete rate-limit event) still
-    // classifies as the cap (`usage_capped`).
+    // A cap signalled only by the result's `terminal_reason:'blocking_limit'` (no rate-limit event)
+    // still classifies as `usage_capped`.
     name: "blocking_limit terminal reason \u2192 usage_capped",
     request: makeRequest(),
     nativeStream: [
@@ -5204,8 +5031,8 @@ var BASE_CLAUDE_CODE_CONFORMANCE_FIXTURES = [
     expected: [sessionEvent("s1"), { type: "result", ok: false, reason: "usage_capped" }]
   },
   {
-    // CT558: an expired login surfaces as an `auth_status` error frame; the failing
-    // result classifies as `auth_expired`.
+    // An expired login surfaces as an `auth_status` error frame; the failing result classifies as
+    // `auth_expired`.
     name: "expired login \u2192 auth_expired",
     request: makeRequest(),
     nativeStream: [
@@ -5219,10 +5046,9 @@ var BASE_CLAUDE_CODE_CONFORMANCE_FIXTURES = [
     expected: [sessionEvent("s1"), { type: "result", ok: false, reason: "auth_expired" }]
   },
   {
-    // CT592: a transient provider outage surfaced in the terminal result text (no
-    // structured event/enum) — a 529 overload — classifies as `server_error` via
-    // the text fallback. It must NOT read as the cap and must not stamp the
-    // connector `limited` (the whole point of the honest taxonomy).
+    // A transient provider outage in the terminal result text (no structured event or enum) — a 529
+    // overload — classifies as `server_error` via the text fallback. It must not read as the cap or
+    // stamp the connector `limited`.
     name: "provider overload text \u2192 server_error",
     request: makeRequest(),
     nativeStream: [
@@ -5235,11 +5061,9 @@ var BASE_CLAUDE_CODE_CONFORMANCE_FIXTURES = [
     expected: [sessionEvent("s1"), { type: "result", ok: false, reason: "server_error" }]
   },
   {
-    // CT601: the resolved model is captured off `system/init.model` and attached
-    // to the terminal `result` — even on a plain resume (this fixture resumes, so
-    // no `session` event fires, proving the model doesn't ride the session event).
-    // The configured request model is irrelevant here; what's asserted is that the
-    // concrete id the HARNESS reported comes home.
+    // The resolved model is captured off `system/init.model` and attached to the terminal `result`
+    // even on a plain resume (this fixture resumes, so no `session` event fires). What's asserted is
+    // that the concrete id the harness reported comes home.
     name: "resolved model captured from system/init",
     request: makeRequest({ session: encodeSession({ sdkSessionId: "s1", cwd: CWD }) }),
     nativeStream: [init("s1", "claude-opus-4-8"), assistantText("Done."), resultSuccess("s1")],
@@ -5249,9 +5073,8 @@ var BASE_CLAUDE_CODE_CONFORMANCE_FIXTURES = [
     ]
   },
   {
-    // Session resume echo: the stored state matches the current cwd, so we resume
-    // its SDK id; `system/init` echoes that same id, so NO session event fires
-    // (the id didn't change).
+    // Session resume echo: the stored state matches the cwd, so its SDK id is resumed and
+    // `system/init` echoes the same id — no session event fires.
     name: "session resume (no re-emit on echo)",
     request: makeRequest({ session: encodeSession({ sdkSessionId: "s1", cwd: CWD }) }),
     nativeStream: [init("s1"), assistantText("Back again."), resultSuccess("s1")],
@@ -5261,16 +5084,14 @@ var BASE_CLAUDE_CODE_CONFORMANCE_FIXTURES = [
     ]
   },
   {
-    // SJ527 cwd-mismatch degrade: the stored state was created under a DIFFERENT
-    // cwd, so the adapter refuses to resume and starts fresh — `system/init`
-    // reports a new id, and the emitted session event records the CURRENT cwd.
+    // Cwd-mismatch degrade: the stored state was created under another cwd, so the adapter starts
+    // fresh — `system/init` reports a new id, and the session event records the current cwd.
     name: "session cwd-mismatch degrades to fresh",
     request: makeRequest({ session: encodeSession({ sdkSessionId: "old", cwd: "/env/gone" }) }),
     nativeStream: [init("fresh1"), assistantText("Fresh start."), resultSuccess("fresh1")],
     expected: [
-      // CT315: the degrade is flagged on the session event so the host relays it
-      // on settle and the server rewinds the catch-up mark (recovering the
-      // pre-mark context the discarded session no longer carries).
+      // The degrade is flagged on the session event so the host relays it on settle and the server
+      // rewinds the catch-up mark (recovering context the discarded session no longer carries).
       sessionEvent("fresh1", CWD, true),
       { type: "text", body: "Fresh start.", terminal: true },
       { type: "result", ok: true }
@@ -5913,8 +5734,6 @@ function createOpencodeAdapter(deps = {}) {
   const transport = deps.transport ?? (deps.serverUrl ? createHttpOpencodeTransport({ baseUrl: deps.serverUrl }) : null);
   return {
     name: "opencode",
-    // CT829: one surface, so one addendum and no parameter — CT614's `codeMode`
-    // argument went with the named tool surface it selected against.
     promptAddendum: () => OPENCODE_ADDENDUM,
     dialectSchema: opencodeDialectSchema,
     async *runTurn(request, signal, hooks) {
@@ -6077,15 +5896,12 @@ var OPENCODE_CONFORMANCE_FIXTURES = [
     ]
   },
   {
-    // CT301: a STREAMING provider's tool input arrives late. opencode re-emits the
-    // tool part as a full snapshot as the args parse: DeepSeek sends `input: {}` on
-    // the early `pending`/`running` frame and the full args only on a later snapshot
-    // (live-captured against opencode 1.17: `pending {}` → `running {full}` →
-    // `completed {full}`). The `start` event fires immediately off the first (empty)
-    // frame — that's the live card — but the `done` event (and the DB row it
-    // upserts) must carry the LATEST non-empty input + its summary, not the
-    // first-seen `{}`. This is the case the pre-CT301 suite structurally couldn't
-    // catch: every other tool fixture bakes the full input into the first snapshot.
+    // A streaming provider's tool input arrives late. opencode re-emits the tool part as a full
+    // snapshot as the args parse: DeepSeek sends `input: {}` on the early `pending`/`running` frame
+    // and the full args on a later one (captured on opencode 1.17: `pending {}` → `running {full}` →
+    // `completed {full}`). `start` fires off the first (empty) frame — the live card — but `done`
+    // (and the row it upserts) must carry the latest non-empty input and its summary. Every other
+    // tool fixture bakes the full input into the first snapshot, so only this one catches it.
     name: "streaming tool input \u2014 late args refresh the done event (CT301)",
     request: makeRequest2(),
     nativeStream: [
@@ -6123,9 +5939,8 @@ var OPENCODE_CONFORMANCE_FIXTURES = [
     ]
   },
   {
-    // HIGHEST-RISK: cancel mid-stream. The abort lands after the tool result; the
-    // adapter stops before the closing reply — no final text, no `result` event.
-    // CT1295: the server writes the `kind:'stopped'` marker.
+    // Highest risk: cancel mid-stream. The abort lands after the tool result; the adapter stops before
+    // the closing reply — no final text, no `result` event (the server writes the stopped marker).
     name: "cancel mid-stream",
     request: makeRequest2(),
     nativeStream: [
@@ -6165,10 +5980,9 @@ var OPENCODE_CONFORMANCE_FIXTURES = [
     ]
   },
   {
-    // CT558/CT592: a provider 429 throttle. The wrapped `RateLimitError` is
-    // unwrapped by `readSessionError` then text-classified — a bare "rate limit
-    // (429)" with no cap noun is the throttle (`rate_limited`), distinct from the
-    // account cap. opencode is text-only so it inherits the CT592 split for free.
+    // A provider 429 throttle. The wrapped `RateLimitError` is unwrapped by `readSessionError` and
+    // text-classified: a bare "rate limit (429)" with no cap noun is the throttle (`rate_limited`),
+    // not the account cap.
     name: "provider 429 \u2192 rate_limited (throttle, no reset)",
     request: makeRequest2(),
     nativeStream: [
@@ -6184,9 +5998,8 @@ var OPENCODE_CONFORMANCE_FIXTURES = [
     ]
   },
   {
-    // CT592: a subscription cap surfaced as text ("usage limit reached") → the cap
-    // (`usage_capped`). opencode carries no reset hint, so it's reset-less (the
-    // server renders "try again later").
+    // A subscription cap surfaced as text ("usage limit reached") → `usage_capped`. opencode carries
+    // no reset hint, so it's reset-less (the server says "try again later").
     name: "usage cap text \u2192 usage_capped (no reset)",
     request: makeRequest2(),
     nativeStream: [
@@ -6202,9 +6015,7 @@ var OPENCODE_CONFORMANCE_FIXTURES = [
     ]
   },
   {
-    // CT592: a transient provider outage (5xx / overload) surfaced as text → the
-    // honest `server_error`, never the cap. This is the outage class that used to
-    // fall through to an opaque `unknown`.
+    // A transient provider outage (5xx / overload) surfaced as text → `server_error`, never the cap.
     name: "provider overload text \u2192 server_error",
     request: makeRequest2(),
     nativeStream: [
@@ -6222,7 +6033,7 @@ var OPENCODE_CONFORMANCE_FIXTURES = [
     ]
   },
   {
-    // CT558: an expired/invalid credential classifies as `auth_expired`.
+    // An expired or invalid credential classifies as `auth_expired`.
     name: "auth failure \u2192 auth_expired",
     request: makeRequest2(),
     nativeStream: [
@@ -6238,8 +6049,8 @@ var OPENCODE_CONFORMANCE_FIXTURES = [
     ]
   },
   {
-    // CT1351: an unclassified failure remains as informative as a classified one:
-    // its provider text is visible while the raw machine reason stays unchanged.
+    // An unclassified failure stays informative: its provider text is visible, and the raw machine
+    // reason is unchanged.
     name: "unclassified failure keeps a runtime notice and raw reason",
     request: makeRequest2(),
     nativeStream: [errored("something local broke")],
@@ -6260,8 +6071,8 @@ var OPENCODE_CONFORMANCE_FIXTURES = [
     ]
   },
   {
-    // CT1351: empty, whitespace-only, and bare status-token failures still set
-    // the machine reason but do not add an empty/unhelpful transcript notice.
+    // Empty, whitespace-only and bare status-token failures still set the machine reason but add no
+    // empty or unhelpful transcript notice.
     name: "empty failure text emits no runtime notice",
     request: makeRequest2(),
     nativeStream: [errored("")],
@@ -6293,12 +6104,10 @@ var OPENCODE_CONFORMANCE_FIXTURES = [
     ]
   },
   {
-    // CT1144: the same zero-content success the claude-code suite pins, in
-    // opencode's vocabulary — the session goes idle having emitted no part at
-    // all. No opencode sample of the anomaly has been seen in the wild; the
-    // fixture exists because the host's classification is runtime-neutral, so a
-    // runtime that CAN produce this envelope must be shown producing it in the
-    // shape the classifier reads.
+    // The zero-content success the claude-code suite pins, in opencode's vocabulary — the session
+    // goes idle having emitted no part. No opencode sample has been seen; the fixture exists because
+    // the host's classification is runtime-neutral, so a runtime that can produce this envelope must
+    // be shown producing it in the shape the classifier reads.
     name: "zero-content success (empty runtime result)",
     request: makeRequest2(),
     nativeStream: [idle()],
@@ -6355,10 +6164,9 @@ var OPENCODE_CONFORMANCE_FIXTURES = [
     ]
   },
   {
-    // CT298: the stored state matches the current directory, so the adapter resumes
-    // its id and the transport reports `created:false` on the same id — NO session
-    // event fires (the id didn't change). This is the resume-echo case CT294
-    // removed; restoring it is the crux of restoring cross-turn memory.
+    // The stored state matches the directory, so the adapter resumes its id and the transport reports
+    // `created:false` on the same id — no session event fires. Resume is what carries cross-turn
+    // memory.
     name: "session resume (no re-emit on echo)",
     request: makeRequest2({ session: encodeSession2({ sessionId: "s1", directory: DIR }) }),
     nativeStream: [textPart("p1", "Back again."), idle()],
@@ -6368,12 +6176,10 @@ var OPENCODE_CONFORMANCE_FIXTURES = [
     ]
   },
   {
-    // CT298: on a resumed turn the transport mints NO client message id (supplying
-    // one no-ops the turn), so the decoder can't be handed a `skipMessageId` up
-    // front. It learns the user-message id from the stream — the `message.updated`
-    // user frame precedes that message's echoed part — and drops the echo, so the
-    // injected per-turn context still can't leak into Steps. Only the assistant
-    // reply surfaces. No session event (resume echo on the same id).
+    // On a resumed turn the transport mints no client message id (doing so no-ops the turn), so the
+    // decoder gets no `skipMessageId`. It learns the user-message id from the stream — the
+    // `message.updated` user frame precedes the echoed part — and drops the echo, so the injected
+    // per-turn context can't leak into Steps. Only the reply surfaces; no session event.
     name: "session resume \u2014 prompt echo filtered via stream-derived user id",
     request: makeRequest2({ session: encodeSession2({ sessionId: "s1", directory: DIR }) }),
     nativeStream: [
@@ -6389,17 +6195,15 @@ var OPENCODE_CONFORMANCE_FIXTURES = [
     ]
   },
   {
-    // Directory-mismatch degrade (the SJ527 analogue): the stored state was
-    // created under a DIFFERENT directory, so the adapter refuses to resume and
-    // starts fresh — the transport creates a new session, and the emitted session
-    // event records the CURRENT directory.
+    // Directory-mismatch degrade: the stored state was created under another directory, so the
+    // adapter starts fresh — the transport creates a new session, and the session event records the
+    // current directory.
     name: "session directory-mismatch degrades to fresh",
     request: makeRequest2({ session: encodeSession2({ sessionId: "old", directory: "/env/gone" }) }),
     nativeStream: [textPart("p1", "Fresh start."), idle()],
     expected: [
-      // CT315: the degrade is flagged on the session event (parity with
-      // claude-code) so the host relays it on settle and the server rewinds the
-      // catch-up mark, recovering the context the discarded session dropped.
+      // The degrade is flagged on the session event so the host relays it on settle and the server
+      // rewinds the catch-up mark, recovering context the discarded session dropped.
       sessionEvent2(NEW_SESSION_ID, DIR, true),
       { type: "text", body: "Fresh start.", terminal: true },
       { type: "result", ok: true }
@@ -6417,11 +6221,9 @@ var CODEX_ADDENDUM = [
   "absent without attempting discovery and invocation, and if a call fails, report the recorded",
   "error.",
   turnControlPromptGuidance("mcp__cabane_companion__"),
-  // CT1552: every ancillary tool is written the way Codex's own tool list shows
-  // it — qualified. The bare `read_binary` / `upload` / … this list used to mix
-  // in sat two lines under the instruction to invoke the exact qualified names,
-  // so the sentence contradicted itself. The bare `query` / `mutate` below stay:
-  // that sentence is about operation names, after the qualified forms are given.
+  // Every ancillary tool is written as Codex's own tool list shows it — qualified — so the sentence
+  // instructing exact qualified names doesn't contradict itself. The bare `query` / `mutate` below
+  // stay: that sentence is about operation names, after the qualified forms are given.
   "The ancillary tools are `mcp__cabane__read_binary`, `mcp__cabane__upload`,",
   "`mcp__cabane__begin_upload`, `mcp__cabane__finalize_upload` and",
   "`mcp__cabane__mint_render_token` \u2014 all possibly deferred too.",
@@ -6665,10 +6467,9 @@ async function* decodeCodexStream(events, ctx) {
           threadId,
           cwd: ctx.cwd ?? "",
           promptFingerprint: ctx.promptFingerprint ?? null,
-          // CT1645: the baseline this turn INHERITED, carried through unchanged.
-          // This early write exists so a turn that dies mid-stream still leaves
-          // the thread id recorded; it cannot yet know what this turn will spend.
-          // The closing write below records the new baseline.
+          // The baseline this turn inherited, carried through unchanged. This early write records the
+          // thread id even if the turn dies mid-stream; it can't yet know what the turn will spend. The
+          // closing write records the new baseline.
           usageBaseline: ctx.usageBaseline ?? null
         });
         if (threadId !== ctx.resumedThreadId || state !== ctx.storedState) {
@@ -6952,9 +6753,8 @@ function buildConfig(req, baseInstructionsFile) {
   return {
     mcp_servers,
     experimental_use_rmcp_client: true,
-    // CT871: the no-host-access prompt replacement — Cabane's composed prompt
-    // becomes Codex's base instructions, and Codex's own environment preamble goes
-    // with the harness prompt it belonged to.
+    // The no-host-access prompt replacement — Cabane's composed prompt becomes Codex's base
+    // instructions, and Codex's environment preamble goes with the harness prompt it belonged to.
     ...baseInstructionsFile ? { model_instructions_file: baseInstructionsFile, include_environment_context: false } : {},
     ...Object.keys(shellEnv).length ? { shell_environment_policy: { set: shellEnv } } : {}
   };
@@ -7051,16 +6851,11 @@ function createSdkCodexTransport(opts = {}) {
       const codexOptions = {
         ...opts.apiKey ? { apiKey: opts.apiKey } : {},
         ...opts.codexPathOverride ? { codexPathOverride: opts.codexPathOverride } : {},
-        // The `--config` overrides (MCP servers + rmcp flag). CT1501: rendered to
-        // finished `--config` strings by US and passed through `configOverrides`,
-        // the SDK's raw passthrough — NOT through `config`, which would flatten
-        // them itself. A user MCP server named `my.server` cannot go in an
-        // override's dotted path at all (the CLI splits the path on `.` and
-        // ignores TOML quoting), so it has to ride inside an inline-table value,
-        // and the SDK's flattener cannot be steered into producing one. This is
-        // also what makes the PUBLISHED companion correct, where the vendored
-        // patch never reached — and why that patch is gone. See
-        // `config-overrides.ts`.
+        // The `--config` overrides (MCP servers + rmcp flag), rendered to finished `--config` strings
+        // here and passed through `configOverrides`, the SDK's raw passthrough — not `config`, which
+        // flattens them itself. A user MCP server named `my.server` can't go in an override's dotted
+        // path (the CLI splits on `.` and ignores TOML quoting), so it must ride inside an inline-table
+        // value, which the SDK's flattener can't produce. See `config-overrides.ts`.
         configOverrides: buildConfigOverrides(spec.config),
         ...spec.secretEnv ? { env: codexProcessEnv(spec.secretEnv) } : {}
       };
@@ -7078,8 +6873,6 @@ function createCodexAdapter(deps = {}) {
   const transport = deps.transport ?? (deps.enabled ? createSdkCodexTransport({ ...deps.apiKey ? { apiKey: deps.apiKey } : {} }) : null);
   return {
     name: "codex",
-    // CT829: one surface, so one addendum and no parameter — CT614's `codeMode`
-    // argument went with the named tool surface it selected against.
     promptAddendum: () => CODEX_ADDENDUM,
     dialectSchema: codexDialectSchema,
     async *runTurn(request, signal, hooks) {
@@ -7171,17 +6964,14 @@ function createCodexAdapter(deps = {}) {
           cwd: req.local.cwd,
           resumedThreadId: resumeThreadId,
           degraded,
-          // CT1075: which prompt the thread carries once this turn lands. If we sent
-          // one, it's that one — a later copy is what the model reads, so a changed
-          // prompt supersedes the older copy still sitting above it. If we withheld
-          // it, the thread still carries whatever it did before. Read off the spec
-          // rather than recomputed, so the recorded fact can't disagree with what
-          // was actually sent.
+          // Which prompt the thread carries once this turn lands. If we sent one, it's that one — the
+          // later copy is what the model reads. If we withheld it, the thread carries what it did. Read
+          // off the spec, so the record can't disagree with what was sent.
           promptFingerprint: spec.promptRidesInput ? spec.promptFingerprint : threadPromptFingerprint,
           storedState: req.session,
           usageBaseline: threadUsageBaseline,
-          // CT601: Codex reports no model in-stream, so record what the thread was
-          // started with (null on the default token). Same for the reasoning effort.
+          // Codex reports no model in-stream, so record what the thread was started with (null on the
+          // default token). Same for the reasoning effort.
           resolvedModel: spec.model,
           resolvedReasoningEffort: spec.modelReasoningEffort ?? null
         });
@@ -7230,11 +7020,9 @@ function makeRequest3(overrides2 = {}) {
     systemPrompt: PROMPT,
     prompt: "hi there",
     content: [{ type: "text", text: "hi there" }],
-    // CT601: the resolved model + reasoning effort ride the terminal `result` off
-    // the run spec's model. The behavioral fixtures below don't assert them, so the
-    // default is the model-less ("let Codex choose") token → no `resolvedModel`
-    // emitted → their expected results stay unchanged; a dedicated capture fixture
-    // sets a real model + effort.
+    // The resolved model and reasoning effort ride the terminal `result` off the run spec's model.
+    // Behavioural fixtures use the model-less token (no `resolvedModel` emitted); a dedicated capture
+    // fixture sets a real model and effort.
     config: { model: null },
     policy: COMPANION_POLICY2,
     session: null,
@@ -7286,13 +7074,12 @@ var sessionEvent3 = (threadId, cwd = DIR2, degraded = false, promptFingerprint =
 });
 var CODEX_CONFORMANCE_FIXTURES = [
   {
-    // A plain text reply: the held agent message seals as the terminal final at
-    // `turn.completed`; the usage counters ride the `result`.
+    // A plain text reply: the held agent message seals as the terminal final at `turn.completed`;
+    // usage rides the `result`.
     //
-    // CT1283: the counters NEST — `cached_input_tokens` is a slice of
-    // `input_tokens`, `reasoning_output_tokens` a slice of `output_tokens` — so
-    // input is 100 (not 120) and output is 50 (not 60), with the cache read broken
-    // out beside them. This fixture pinned the double-count before CT1283.
+    // The counters nest — `cached_input_tokens` is a slice of `input_tokens`,
+    // `reasoning_output_tokens` a slice of `output_tokens` — so input is 100 (not 120) and output 50
+    // (not 60), with the cache read broken out beside them.
     name: "clean turn",
     request: makeRequest3(),
     nativeStream: [
@@ -7309,10 +7096,8 @@ var CODEX_CONFORMANCE_FIXTURES = [
     expected: [
       sessionEvent3(NEW_THREAD_ID),
       { type: "text", body: "Hello there.", terminal: true },
-      // CT1645: the closing session write — the thread's ending totals, recorded
-      // as the baseline the NEXT turn subtracts. This is a fresh thread, so the
-      // `result` usage below is the frame verbatim (nothing to subtract yet);
-      // what makes it per-turn is this figure being carried into turn two.
+      // The closing session write — the thread's ending totals, recorded as the baseline the next turn
+      // subtracts. A fresh thread, so the `result` usage below is the frame verbatim.
       sessionEvent3(NEW_THREAD_ID, DIR2, false, fingerprintPrompt(PROMPT), {
         inputTokens: 100,
         outputTokens: 50,
@@ -7384,8 +7169,8 @@ var CODEX_CONFORMANCE_FIXTURES = [
     ]
   },
   {
-    // CT1211: recorded MCP success shape. Codex exposes the text compatibility
-    // copy and the native object together; normalization must keep the object.
+    // The recorded MCP success shape: Codex exposes the text copy and the native object together;
+    // normalization must keep the object.
     name: "MCP success prefers native structured content",
     request: makeRequest3(),
     nativeStream: [
@@ -7435,8 +7220,8 @@ var CODEX_CONFORMANCE_FIXTURES = [
     ]
   },
   {
-    // CT1211 incident shape: MCP `isError` keeps the failed phase, while the raw
-    // camel-case structured payload survives instead of the generic `error` token.
+    // MCP `isError` keeps the failed phase, while the raw camel-case structured payload survives
+    // instead of the generic `error` token.
     name: "failed MCP call preserves structured receipt while remaining error phase",
     request: makeRequest3(),
     nativeStream: [
@@ -7488,8 +7273,8 @@ var CODEX_CONFORMANCE_FIXTURES = [
     ]
   },
   {
-    // A transport/tool failure has no MCP result payload and still uses the real
-    // adapter error message. CT1211 must not replace this fallback with `undefined`.
+    // A transport/tool failure with no MCP result payload still uses the real adapter error message,
+    // never `undefined`.
     name: "failed MCP call without result keeps error message fallback",
     request: makeRequest3(),
     nativeStream: [
@@ -7529,8 +7314,8 @@ var CODEX_CONFORMANCE_FIXTURES = [
     ]
   },
   {
-    // CT1147 stays intact when a connector includes structured metadata beside an
-    // image-only MCP response: no image/base64 payload enters activity receipts.
+    // A connector's structured metadata beside an image-only MCP response: no image/base64 payload
+    // enters activity receipts.
     name: "image-only MCP result remains empty despite structured metadata",
     request: makeRequest3(),
     nativeStream: [
@@ -7623,12 +7408,10 @@ var CODEX_CONFORMANCE_FIXTURES = [
     ]
   },
   {
-    // CT715: web_search LIFECYCLE. Unlike the other three tool kinds, a `web_search`
-    // item carries NO `status` field — completion is signaled by the frame TYPE
-    // (`item.started` → `item.completed`). The `start` fires off the first frame
-    // (empty query, no output card); the `done` must resolve off `item.completed`
-    // and carry the populated query the completed frame filled in. Before CT715 the
-    // card was pinned at "running" forever (status derived from a missing field).
+    // web_search lifecycle. A `web_search` item carries no `status` — completion is signalled by the
+    // frame type (`item.started` → `item.completed`). The `start` fires off the first frame (empty
+    // query); the `done` must resolve off `item.completed` with the populated query, not stay
+    // "running".
     name: "web_search lifecycle \u2014 completes off frame type, populated query on done",
     request: makeRequest3(),
     nativeStream: [
@@ -7659,9 +7442,8 @@ var CODEX_CONFORMANCE_FIXTURES = [
     ]
   },
   {
-    // CT715: a non-text web action (`action.type: "other"`) legitimately completes
-    // with an EMPTY query — that's Codex's own data, not our bug. It must still
-    // resolve to `done` (empty query acceptable; stuck-running is not).
+    // A non-text web action (`action.type: "other"`) legitimately completes with an empty query —
+    // Codex's own data. It must still resolve to `done`.
     name: "web_search lifecycle \u2014 empty-query completion still resolves to done",
     request: makeRequest3(),
     nativeStream: [
@@ -7692,9 +7474,8 @@ var CODEX_CONFORMANCE_FIXTURES = [
     ]
   },
   {
-    // HIGHEST-RISK: cancel mid-stream. The abort lands after the tool result; the
-    // adapter stops before the closing reply — no final text, no `result` event.
-    // CT1295: the server writes the `kind:'stopped'` marker.
+    // Highest risk: cancel mid-stream. The abort lands after the tool result; the adapter stops before
+    // the closing reply — no final text, no `result` event (the server writes the stopped marker).
     name: "cancel mid-stream",
     request: makeRequest3(),
     nativeStream: [
@@ -7775,11 +7556,8 @@ var CODEX_CONFORMANCE_FIXTURES = [
     ]
   },
   {
-    // CT592: Codex used to classify NOTHING — every `turn.failed` became a raw
-    // `error:<text>` `unknown`. It now routes the failure text through the shared
-    // classifier (Codex is text-only), so a provider 429 / outage / auth / cap
-    // failure splits into the honest taxonomy instead of all reading `unknown`.
-    // This is a real behavior change, not a refactor. One fixture per kind:
+    // The failure text goes through the shared classifier (Codex is text-only), so a provider 429 /
+    // outage / auth / cap failure splits into the honest taxonomy. One fixture per kind:
     name: "turn.failed 429 \u2192 rate_limited (throttle)",
     request: makeRequest3(),
     nativeStream: [threadStarted(NEW_THREAD_ID), turnFailed("429 Too Many Requests")],
@@ -7826,8 +7604,8 @@ var CODEX_CONFORMANCE_FIXTURES = [
     ]
   },
   {
-    // CT592: a Codex failure text the classifier can't place still keeps today's
-    // raw `error:<text>` reason (the `unknown` fallback) — nothing regresses.
+    // A failure text the classifier can't place keeps the raw `error:<text>` reason (the `unknown`
+    // fallback).
     name: "turn.failed unclassified \u2192 raw error reason (unchanged)",
     request: makeRequest3(),
     nativeStream: [threadStarted(NEW_THREAD_ID), turnFailed("something local broke")],
@@ -7851,8 +7629,8 @@ var CODEX_CONFORMANCE_FIXTURES = [
     ]
   },
   {
-    // CT1351: empty, whitespace-only, and bare status-token failures still set
-    // the machine reason but do not add an empty/unhelpful transcript notice.
+    // Empty, whitespace-only and bare status-token failures still set the machine reason but add no
+    // empty or unhelpful transcript notice.
     name: "empty failure text emits no runtime notice",
     request: makeRequest3(),
     nativeStream: [threadStarted(NEW_THREAD_ID), turnFailed("")],
@@ -7881,11 +7659,9 @@ var CODEX_CONFORMANCE_FIXTURES = [
     ]
   },
   {
-    // CT481: fail LOUD on unknown model metadata. An unknown `--model` makes Codex
-    // emit an `error` item ("… Defaulting to fallback metadata …") and then go
-    // haywire (the spurious tool call scripted after it MUST never be emitted). The
-    // adapter ends the turn the moment the signal lands, with a machine reason — so
-    // a future Codex id-drop errors clean instead of degrading mid-tool-turn.
+    // Fail loud on unknown model metadata. An unknown `--model` makes Codex emit an `error` item
+    // ("… Defaulting to fallback metadata …") and misbehave (the spurious tool call scripted after it
+    // must never be emitted). The adapter ends the turn when the signal lands, with a machine reason.
     name: "unknown model metadata \u2192 fail loud (guard)",
     request: makeRequest3(),
     nativeStream: [
@@ -7931,12 +7707,10 @@ var CODEX_CONFORMANCE_FIXTURES = [
     ]
   },
   {
-    // CT1144: the same zero-content success the claude-code suite pins, in
-    // Codex's vocabulary — the thread starts, the turn completes, and nothing is
-    // emitted in between. No Codex sample of the anomaly has been seen in the
-    // wild; the fixture exists because the host's classification is runtime-
-    // neutral, so a runtime that CAN produce this envelope must be shown
-    // producing it in the shape the classifier reads.
+    // The zero-content success the claude-code suite pins, in Codex's vocabulary — the thread
+    // starts, the turn completes, nothing in between. No Codex sample has been seen; the fixture
+    // exists because the host's classification is runtime-neutral, so a runtime that can produce
+    // this envelope must be shown producing it in the shape the classifier reads.
     name: "zero-content success (empty runtime result)",
     request: makeRequest3(),
     nativeStream: [threadStarted(NEW_THREAD_ID), turnCompleted()],
@@ -8005,11 +7779,10 @@ var CODEX_CONFORMANCE_FIXTURES = [
     ]
   },
   {
-    // CT601: Codex reports no model in-stream, so the resolved model + reasoning
-    // effort come from what the thread was STARTED with (the run spec) and ride the
-    // terminal `result`. A real model + a `runtimeOptions.codex.modelReasoningEffort`
-    // are asserted through to `resolvedModel` (bare, `openai/`-stripped) and
-    // `resolvedConfig.reasoningEffort`.
+    // Codex reports no model in-stream, so the resolved model and reasoning effort come from what the
+    // thread was started with (the run spec) and ride the terminal `result`: a real model and a
+    // `runtimeOptions.codex.modelReasoningEffort` are asserted through to `resolvedModel` (bare,
+    // `openai/`-stripped) and `resolvedConfig.reasoningEffort`.
     name: "resolved model + reasoning effort captured from run spec",
     request: makeRequest3({
       config: {
@@ -8030,15 +7803,12 @@ var CODEX_CONFORMANCE_FIXTURES = [
     ]
   },
   {
-    // Session resume: the stored state matches the current directory, so the adapter
-    // resumes its thread id and `thread.started` echoes the SAME id — NO session
-    // event fires (the id didn't change AND the state is unchanged). This is what
-    // carries cross-turn memory.
+    // Session resume: the stored state matches the directory, so the thread id is resumed and
+    // `thread.started` echoes it — no session event fires. This is what carries cross-turn memory.
     //
-    // CT1075: the stored state also says the thread already holds the composed
-    // prompt, so this turn withholds the preamble and the state it would write is
-    // byte-identical to the stored one. The silence is now proof of BOTH: an id that
-    // didn't change and a prompt that didn't need re-sending.
+    // The stored state also says the thread already holds the composed prompt, so this turn
+    // withholds the preamble and the state it would write is byte-identical: the silence proves both
+    // an unchanged id and a prompt that needed no re-send.
     name: "session resume (no re-emit on echo)",
     request: makeRequest3({
       session: encodeSession3({
@@ -8055,16 +7825,12 @@ var CODEX_CONFORMANCE_FIXTURES = [
     ]
   },
   {
-    // CT1075: a resumed thread the platform's state does NOT vouch for — a state
-    // written before CT1075 existed, so it carries no `promptFingerprint` field. The
-    // adapter reads the absence as "we can't say which prompt this thread holds",
-    // sends the full prompt exactly as it did pre-CT1075, and re-emits the state with
-    // the fingerprint recorded — on the SAME thread id, which pre-CT1075 emitted
-    // nothing at all. That re-emit is the upgrade path: without it a long-lived
-    // thread would re-send the whole prompt forever.
+    // A resumed thread whose stored state carries no `promptFingerprint` field. The adapter reads the
+    // absence as "can't say which prompt this thread holds", sends the full prompt, and re-emits the
+    // state with the fingerprint — on the same thread id. That re-emit is the upgrade path: without
+    // it a long-lived thread would re-send the whole prompt forever.
     //
-    // This is the fixture that fails if the static half is withheld on a thread we
-    // have no evidence about.
+    // This fixture fails if the standing half is withheld on a thread we have no evidence about.
     name: "session resume with a pre-CT1075 state re-emits with the prompt fingerprint",
     request: makeRequest3({
       session: JSON.stringify({ threadId: "th1", cwd: DIR2 })
@@ -8077,14 +7843,12 @@ var CODEX_CONFORMANCE_FIXTURES = [
     ]
   },
   {
-    // CT1075 (review finding): the thread carries a DIFFERENT prompt than the one
-    // this turn composed — a charter edit, a renamed agent, a redeployed prompt
-    // body. The stored fingerprint doesn't match, so the new prompt is sent exactly
-    // as on a fresh thread and the state is re-recorded against it.
+    // The thread carries a different prompt than this turn composed — a charter edit, a renamed
+    // agent, a redeployed prompt body. The fingerprint doesn't match, so the new prompt is sent as on
+    // a fresh thread and the state re-recorded.
     //
-    // This is the fixture that fails if a stale prompt is treated as good enough. A
-    // boolean flag would have passed the resume fixture above and silently withheld
-    // every future charter edit from this thread.
+    // This fixture fails if a stale prompt is treated as good enough; a boolean flag would pass the
+    // resume fixture above and withhold every future charter edit.
     name: "session resume with a stale prompt fingerprint re-sends the prompt",
     request: makeRequest3({
       session: encodeSession3({
@@ -8102,15 +7866,12 @@ var CODEX_CONFORMANCE_FIXTURES = [
     ]
   },
   {
-    // Directory-mismatch degrade (the SJ527 analogue): the stored state was created
-    // under a DIFFERENT directory, so the adapter refuses to resume and starts
-    // fresh — `thread.started` reports a NEW id, and the emitted session event
-    // records the CURRENT directory with `degraded: true` so the host rewinds the
-    // catch-up mark.
+    // Directory-mismatch degrade: the stored state was created under another directory, so the
+    // adapter starts fresh — `thread.started` reports a new id, and the session event records the
+    // current directory with `degraded: true` so the host rewinds the catch-up mark.
     //
-    // CT1075: the refused resume means the new thread is EMPTY, so the full prompt
-    // goes in even though the stored state vouched for a copy — of a thread we're
-    // no longer in. The emitted state records the fresh thread's own answer.
+    // The refused resume means the new thread is empty, so the full prompt goes in even though the
+    // stored state vouched for a copy in a thread we're no longer in.
     name: "session directory-mismatch degrades to fresh",
     request: makeRequest3({
       session: encodeSession3({
@@ -8159,7 +7920,7 @@ var ConnectorHealthStore = class {
       lastError: outcome.errorReason ?? null
     });
   }
-  // CT639: the store's current opinion for one runtime, or undefined when it has
+  // The store's current opinion for one runtime, or undefined when it has
   // no observation. Read by the dispatcher at idle-timeout fire: an idle reap
   // while this runtime is definitively `limited` (a present, future `limitedUntil`
   // recorded by a sibling/earlier turn's classified cap settle) is the account cap
@@ -8463,8 +8224,7 @@ function createTurnContainment(turnId, deps = {}) {
       `--unit=${unit}`,
       `--property=TimeoutStopSec=${CONTAINMENT_STOP_GRACE_SEC}s`,
       // Bind the scope's life to the companion's own unit, so stopping or
-      // restarting the companion still takes its in-flight turns with it —
-      // which is what happens today, and what the scope would otherwise undo.
+      // restarting the companion still takes its in-flight turns with it.
       // Omitted outside a unit, where there is nothing to bind to.
       ...ownUnit ? [`--property=PartOf=${ownUnit}`] : [],
       "--"
@@ -8784,7 +8544,7 @@ var mcpHttpServerSchema = z15.object({
   type: z15.literal("http"),
   url: z15.string().url(),
   headers: z15.record(z15.string(), z15.string()).optional(),
-  // CT1698: header → the name of a `secretEnv` entry holding its value. Set by
+  // Header → the name of a `secretEnv` entry holding its value. Set by
   // the server on a room connection's entry, and by `resolveMcpSecrets` on a
   // header whose `${VAR}` it resolved.
   headersFromEnv: z15.record(z15.string(), z15.string()).optional()
@@ -8793,7 +8553,7 @@ var mcpSseServerSchema = z15.object({
   type: z15.literal("sse"),
   url: z15.string().url(),
   headers: z15.record(z15.string(), z15.string()).optional(),
-  // CT1698: header → the name of a `secretEnv` entry holding its value. Set by
+  // Header → the name of a `secretEnv` entry holding its value. Set by
   // the server on a room connection's entry, and by `resolveMcpSecrets` on a
   // header whose `${VAR}` it resolved.
   headersFromEnv: z15.record(z15.string(), z15.string()).optional()
@@ -8806,9 +8566,8 @@ var thinkingConfigSchema = z15.discriminatedUnion("type", [
 ]);
 var effortSchema = z15.enum(["low", "medium", "high", "xhigh", "max"]);
 var runConfigSchema = z15.object({
-  // CT788: the host-access binary replaced the `assistant`/`coding`/`custom` mode
-  // trio + its custom tool lists — `true` grants the host filesystem/shell, absent
-  // is the locked surface. Kept in lockstep with `@cabane/shared`'s
+  // `true` grants the host filesystem/shell; absent is the locked surface. Kept
+  // in lockstep with `@cabane/shared`'s
   // `agentRunConfigSchema` (independent zod, forward-compatible: unknown keys are
   // stripped, so an older companion riding a newer server never rejects the config).
   hostAccess: z15.boolean().optional(),
@@ -8835,7 +8594,7 @@ var RUNNER_ENV = {
   dispatch: "CABANE_DISPATCH",
   // The turn id the launcher resolved, and whether this is a replay of a turn
   // an earlier process started. The seq floor for a replay is derived inside
-  // the turn from the outbox and the server, as it always was.
+  // the turn from the outbox and the server.
   turnId: "CABANE_TURN_ID",
   resumed: "CABANE_RESUMED",
   // Everything else the turn is constructed from, as JSON: see `RunnerSpec`.
@@ -8871,10 +8630,10 @@ var runnerSpecSchema = z16.object({
   // Whether the harness starts under the OS sandbox. The launcher sends 'os'
   // only when this host can make one.
   sandbox: z16.enum(["os", "none"]),
-  // CT1684: the device's sandbox policy, validated by the launcher. Absent
+  // The device's sandbox policy, validated by the launcher. Absent
   // when the sandbox is off.
   sandboxPolicy: sandboxPolicySchema.optional(),
-  // CT1691: every companion store the launcher's latest walk found, denied
+  // Every companion store the launcher's latest walk found, denied
   // to the harness. Absent when the sandbox is off.
   companionStores: z16.array(z16.string()).optional(),
   logLevel: z16.string(),
@@ -8883,15 +8642,15 @@ var runnerSpecSchema = z16.object({
   // True when this (conversation, agent) pair was already told its session
   // could not be saved: the notice is once per pair, not once per process.
   sessionWriteNoticeClaimed: z16.boolean(),
-  // CT1680: the runner's identity, minted with its credential. The start
+  // The runner's identity, minted with its credential. The start
   // PATCH carries it so the lease knows which runner holds the span.
   runnerId: z16.string(),
-  // CT1681: the launcher keeps the runtime's session files beside the attempt
+  // The launcher keeps the runtime's session files beside the attempt
   // and restores them into this runner's home, so the runner names the attempt
   // each context was composed for and waits for the launcher to say it's in
   // place. Absent: nothing to wait for (a runner on the launcher's own disk).
   attemptState: z16.boolean().optional(),
-  // CT1681: MCP `${NAME}` secrets come from the launcher, by name, instead of
+  // MCP `${NAME}` secrets come from the launcher, by name, instead of
   // this machine's secrets.json. Absent: the runner reads the device's file.
   secretsFromLauncher: z16.boolean().optional()
 });
@@ -9520,7 +9279,7 @@ function createTurnControlMcpServer(acts, skipState) {
           return performAct(acts, {
             kind: "ask",
             callId: randomUUID2(),
-            // CT1350: the swap rides the ask, so the server commits both halves
+            // The swap rides the ask, so the server commits both halves
             // in one transaction — the person never sees neither or both.
             ...args.replaces ? { replaces: args.replaces } : {},
             ask: hasArray ? {
@@ -9571,7 +9330,7 @@ function createTurnControlMcpServer(acts, skipState) {
         },
         { annotations: ACT_TOOL, alwaysLoad: true }
       ),
-      // CT1350: the standalone withdrawal. Not annotated destructive — an ask
+      // The standalone withdrawal. Not annotated destructive — an ask
       // is a question, not data, and a harness that gated this on a live
       // operator would hang a turn nobody is watching (the `cancel_wake`
       // reasoning). Not idempotent either: a second call with the same id is
@@ -9590,7 +9349,7 @@ function createTurnControlMcpServer(acts, skipState) {
         }),
         { annotations: ACT_TOOL, alwaysLoad: true }
       ),
-      // CT990: the inverse. No arguments — it can only ever stand down the
+      // The inverse. No arguments — it can only ever stand down the
       // caller's own wake in the conversation it's holding a turn in.
       tool(
         CANCEL_WAKE_TOOL,
@@ -9633,7 +9392,7 @@ function buildCompanionTurnRequest(params) {
       // adapter's `ResolvedMcpServers`.
       ...Object.keys(params.mcpServers).length > 0 ? { mcpServers: params.mcpServers } : {},
       ...params.secretEnv && Object.keys(params.secretEnv).length > 0 ? { secretEnv: params.secretEnv } : {},
-      // CT289: the auto-memory escape hatch, when the operator set it.
+      // The auto-memory escape hatch, when the operator set it.
       ...params.claudeCode ? { claudeCode: params.claudeCode } : {}
     },
     // Host-injected turn-control tools, under their own namespace.
@@ -9887,7 +9646,7 @@ var TranscriptWriter = class {
     }
     this.line({ type: "_meta", ...meta });
   }
-  // Append a raw SDK message verbatim.
+  // Append one event verbatim.
   write(msg) {
     this.line(msg);
   }
@@ -9895,7 +9654,7 @@ var TranscriptWriter = class {
   close(outcome) {
     this.line({ type: "_outcome", ...outcome });
   }
-  // CT1145: keep an independent copy of an empty successful envelope after the
+  // Keep an independent copy of an empty successful envelope after the
   // footer has landed. The ordinary 200-file FIFO keeps rotating as before;
   // this bucket retains the newest 50 anomalies regardless of ordinary traffic.
   // Best-effort like every other transcript operation: observability can never
@@ -9992,6 +9751,8 @@ var TurnCommitter = class {
         summary,
         input,
         result,
+        inputChars,
+        resultChars,
         mcpServer,
         phase,
         seq
@@ -10007,6 +9768,8 @@ var TurnCommitter = class {
             summary,
             input,
             result,
+            ...inputChars !== void 0 ? { inputChars } : {},
+            ...resultChars !== void 0 ? { resultChars } : {},
             mcpServer,
             phase,
             seq,
@@ -10048,12 +9811,9 @@ var TurnCommitter = class {
   // Renders each `TurnEvent` onto the pump's callback sink (tool-log truncation),
   // routing a throwing commit to `onError`.
   emit;
-  // CT261: route one `TurnEvent` from the adapter. `text` / `tool` / `thinking`
-  // flow through the pump (rendered + committed); `session` / `result` are the
-  // dispatcher's concern and ignored here. A throwing commit (a flaky/4xx HTTP
-  // POST) is routed to the error hook and swallowed — a failed commit is
-  // warn-only and must never fail the turn (the role the classification's
-  // `safeEmit` used to play before the adapter owned the decode).
+  // `text` / `tool` / `thinking` flow through the pump; `session` / `result` are
+  // the dispatcher's and ignored here. A throwing commit is routed to the error
+  // hook and swallowed: a failed commit must never fail the turn.
   async ingestEvent(event) {
     if (event.type === "session" || event.type === "result") return;
     try {
@@ -10232,18 +9992,15 @@ var TurnExecution = class {
   turnLog;
   abortController = new AbortController();
   outcome = initialOutcome();
-  // CT1503: this turn's shell containment, once the claude-code adapter is built.
-  // Null before that and on a turn that never reached adapter construction — a
-  // startup failure has nothing to reap, and reaping is a no-op rather than a
-  // special case.
+  // This turn's shell containment, once the claude-code adapter is built. Null
+  // before that, so a startup failure's reap is a no-op.
   containment = null;
   seqCounter = 0;
-  // CT11: per-turn monotonic counter mirroring the in-process dispatcher's.
-  //
-  // CT1380: 0 for a NEW turn only — a resume is seeded in `fetchContext` first.
+  // Per-turn monotonic seq. Starts at 0 for a NEW turn only; a resume is seeded
+  // in `fetchContext` first.
   nextSeq = () => ++this.seqCounter;
-  // CT1380: a REPLAY, told to us by the supervisor — not derivable here, since
-  // `turnId` is set on every dispatch. `resumedFromSeq` is what it seeded from.
+  // A REPLAY, told to us by the supervisor — not derivable here, since `turnId`
+  // is set on every dispatch. `resumedFromSeq` is what it seeded from.
   resumed;
   resumedFromSeq;
   // Whether the span this resumed run continues already has first words —
@@ -10251,8 +10008,8 @@ var TurnExecution = class {
   resumedSpoke = false;
   turnContext;
   resolvedMcpServers;
-  // CT1698: the harness's secret environment for this turn. Only ever handed
-  // to the adapter; never logged, never merged into `process.env`.
+  // The harness's secret environment for this turn. Only ever handed to the
+  // adapter; never logged, never merged into `process.env`.
   secretEnv = {};
   effectiveCwd;
   hookEnv;
@@ -10266,19 +10023,15 @@ var TurnExecution = class {
   turnControlIntentFetched = false;
   applyRecordedTurnControlIntent = async () => {
   };
-  // CT1292: the committer is built before the lease watchdog arms, so the
-  // failed-commit hint reaches it through this slot. Safe as a no-op until the
-  // watchdog replaces it — the committer only fires it from inside the adapter
-  // loop, which runs after.
+  // The committer is built before the lease watchdog arms, so the failed-commit
+  // hint reaches it through this slot. A no-op until then is safe: the committer
+  // only fires it from inside the adapter loop, which runs after.
   noteCommitFailed = () => {
   };
   disarmWatchdogs = () => {
   };
-  // CT1503: reap this turn's shell containment. Idempotent (the containment drops
-  // what it has already stopped) and total — a reap that fails is reported and
-  // swallowed, because a turn that produced a good answer must not be recorded as
-  // failed on account of a leftover process, and the failure is visible in the log
-  // either way.
+  // Idempotent, and a failed reap is logged and swallowed: a turn that produced a
+  // good answer must not be recorded as failed on account of a leftover process.
   async reapContainment() {
     const containment = this.containment;
     if (!containment) return;
@@ -10304,20 +10057,18 @@ var TurnExecution = class {
       );
     }
   }
-  // Codo's stack review, blocking finding #2: set the moment `acquireLease`'s
-  // PATCH returns — the lease is granted and this is the pair's running span,
-  // so every exit after this point must settle THE SPAN, not just clear the
+  // Set the moment `acquireLease`'s PATCH returns: this is the pair's running
+  // span, so every exit after this must settle THE SPAN, not just clear the
   // participant flag.
   admitted = false;
-  // Rooms: one recompose per turn when the lease refuses a stale context.
+  // One recompose per turn when the lease refuses a stale context.
   recomposedForLease = false;
-  // CT1677: the execution source the CURRENT context was adopted as. Reassigned
-  // when a `dispatch_context_stale` recompose adopts a replacement, so a piece of
-  // work — preparation, the committer, a notice — captures it when that work
-  // begins and never reads it again: earlier work keeps its source. Undefined
-  // only before the first adoption; no work runs until it is set.
+  // The execution source the CURRENT context was adopted as. A
+  // `dispatch_context_stale` recompose reassigns it, so each piece of work
+  // (preparation, the committer, a notice) captures it when it begins and keeps
+  // that source. No work runs before it is set.
   executionSourceId;
-  // CT1677: one fresh fetch per turn when adoption is refused.
+  // One fresh fetch per turn when adoption is refused.
   refetchedForAdoption = false;
   concluded(reason, errorReason) {
     return new TurnConcluded(reason, errorReason);
@@ -10385,21 +10136,18 @@ var TurnExecution = class {
     this.supervisor.notifyEnd({ id: payload.messageId, ok: false, durationMs, reason });
     return { ok: false, durationMs, reason, runtime: this.turnContext?.runtime };
   }
-  // The post-admission analogue of `concludeBeforeRun` (Codo's stack review,
-  // blocking finding #2): this turn WAS admitted — it holds the conversation's
-  // lease — so the clear must NAME the turn and DECLARE its terminal outcome.
-  // A bare pre-run clear here would reset the participant flag while the span
-  // stayed running until the lost sweep. `outcome` follows the settle wire's
-  // rule: a failure names its reason; without one the turn settled — the
-  // runtime-unavailable exit posts its user-facing `final` before concluding,
-  // so the turn genuinely produced its terminal output.
+  // The admitted turn holds the conversation's lease, so the clear must NAME the
+  // turn and DECLARE its outcome; a bare clear resets the participant flag and
+  // leaves the span running until the lost sweep. A failure names its reason;
+  // without one the turn settled (the runtime-unavailable exit has already posted
+  // its `final`).
   async concludeAdmittedRun(reason, errorReason) {
     const { payload, turnLog, startedAt, turnId } = this;
     const body = {
       activeRunStartedAt: null,
       turnId,
-      // CT1379: `runtimeIncomplete` is a real failure that deliberately carries
-      // no `errorReason`, so the inference alone would read it as settled.
+      // `runtimeIncomplete` is a real failure that deliberately carries no
+      // `errorReason`, so the inference alone would read it as settled.
       outcome: errorReason || this.outcome.runtimeIncomplete ? "failed" : "settled"
     };
     if (errorReason) body.errorReason = errorReason.slice(0, 200);
@@ -10493,11 +10241,10 @@ var TurnExecution = class {
       throw this.concluded(reason, reason);
     }
   }
-  // CT1677: register this context's issuance as the execution source of the
-  // work about to run on it. A context with no issuance has nothing to adopt,
-  // and that ends the turn exactly as a failed adoption does: this companion
-  // never commits a row whose provenance it cannot name. Only a refusal —
-  // nothing to adopt any more — earns a fresh fetch.
+  // Register this context's issuance as the execution source of the work about to
+  // run on it. No issuance ends the turn as a failed adoption does: this companion
+  // never commits a row whose provenance it cannot name. Only a refusal earns a
+  // fresh fetch.
   async adoptSource(context) {
     const { payload, turnId, turnLog } = this;
     if (!context.issuanceId) {
@@ -10546,9 +10293,8 @@ var TurnExecution = class {
       secretEnv,
       missing
     } = resolveMcpSecrets(
-      // CT262: the user MCP DEFINITIONS (placeholder form) come from the turn
-      // context now, not a separate `getAgentSelf` run-config fetch. CT1698: and
-      // the room connections' entries, whose values arrive in `secretEnv`.
+      // User MCP definitions in placeholder form, plus the room connections'
+      // entries, whose values arrive in `secretEnv`.
       this.turnContext.mcpServers ?? {},
       secretStore,
       this.turnContext.secretEnv
@@ -10661,15 +10407,12 @@ var TurnExecution = class {
               agentUsername: this.opts.agentUsername,
               runtime: this.turnContext.runtime,
               hostAccess: this.turnContext.policy.hostFs,
-              // CT317/CT319: the trigger message's referenced-entry paths — what the
-              // tasker prepare hook keys its per-task env off. Defaults to `[]` for
-              // an older API. The conversation anchor is gone (CT319).
+              // The trigger message's referenced-entry paths, which a prepare hook
+              // may key its per-task env off. `[]` from an older API.
               triggerEntryPaths: this.turnContext.conversation.triggerEntryPaths ?? [],
               title: this.turnContext.conversation.title,
-              // CT943: the dispatching message's text — where an `env:` directive
-              // rides. The server has always sent the trigger body on the turn
-              // context (for the live feed); this is the first thing to read it as
-              // an INPUT, so a dispatch can ask for its environment in words.
+              // Where an `env:` directive rides, so a dispatch can ask for its
+              // environment in words.
               messageBody: this.turnContext.message.body
             },
             { turnId, deviceId: this.opts.deviceId },
@@ -10715,37 +10458,30 @@ var TurnExecution = class {
         payload.agentId,
         {
           activeRunStartedAt: (/* @__PURE__ */ new Date()).toISOString(),
-          // CT1679: a runner leases under its launcher's boot id — the one the
-          // device heartbeats — or the lost-run sweep reads it as a restart.
+          // A runner leases under its launcher's boot id, the one the device
+          // heartbeats, or the lost-run sweep reads it as a restart.
           bootId: this.opts.inRunner?.bootId ?? bootId,
-          // CT1680: the runner holding the span, beside the device's boot id.
           ...this.opts.inRunner ? { runnerId: this.opts.inRunner.runnerId } : {},
-          // CT1380: the durable record that this turn resumed, and from where.
+          // The durable record that this turn resumed, and from where.
           ...this.resumedFromSeq !== void 0 ? { resumedFromSeq: this.resumedFromSeq } : {},
-          // CT1454: the issuance the context THIS attempt runs on came from. Read
-          // off `this.turnContext`, which is the fetch that composed this request —
-          // so a retransmitted start echoes the same id and reuses the same record,
-          // and a resumed attempt echoes its own, newer one. The post-admission
-          // fresh-session recompose (`freshRequest`) deliberately does not touch it:
-          // it adopts only the prompt, never the run-config, so its issuance must
-          // not become this attempt's evidence.
+          // The issuance of the fetch that composed this request, so a
+          // retransmitted start reuses the same record and a resumed attempt
+          // echoes its own. `freshRequest` deliberately leaves it alone: it adopts
+          // only the prompt, never the run-config.
           ...this.turnContext.issuanceId ? { issuanceId: this.turnContext.issuanceId } : {},
-          // CT33: hand the server this turn's id so the new-run chokepoint's
-          // `closeAbandonedTurns` sweep excludes it. The prepare hook may have
-          // already emitted a "preparing" activity row for this turn above (it
-          // runs before this flip), which would otherwise make the sweep mistake
-          // this live turn for an abandoned one and close it with a `stopped`.
+          // So `closeAbandonedTurns` excludes this turn: a "preparing" row emitted
+          // before this flip would otherwise read as abandoned and be stopped.
           turnId,
           // The newest message this turn's read covered: the lease records it,
           // and settle moves the cursor to it. Omitted when the server sent
           // none (an older API), so the cursor stays where it was.
           ...this.turnContext.readThrough !== void 0 ? { readThrough: this.turnContext.readThrough } : {},
           ...this.turnContext.readRevision !== void 0 ? { readRevision: this.turnContext.readRevision } : {},
-          // Rooms: the attempt this request's session belongs to (null = fresh).
+          // The attempt this request's session belongs to (null = fresh).
           ...this.turnContext.attemptId !== void 0 ? { attemptId: this.turnContext.attemptId } : {},
-          // CT1543: the frame this start acts on. The turn-context fetch already
-          // checked it, but that was before an assembly this turn awaited — the
-          // lease checks it again where the stamp is actually taken.
+          // The frame this start acts on. The context fetch checked it before an
+          // assembly this turn awaited; the lease re-checks where the stamp is
+          // taken.
           ...payload.episode !== void 0 ? { dispatchMessageId: payload.messageId, dispatchEpisode: payload.episode } : {}
         }
       );
@@ -10785,21 +10521,18 @@ var TurnExecution = class {
     this.request = buildCompanionTurnRequest({
       turnContext: this.turnContext,
       baseUrl: this.opts.baseUrl,
-      // ACC8: always present; `fetchTurnContext` refused a context without one.
+      // Always present: `fetchContext` refuses a context without one.
       turnToken: this.turnContext.turnToken,
-      // SJ524: the hook-resolved cwd overrides the static local cwd.
       ...this.effectiveCwd ? { cwd: this.effectiveCwd } : {},
-      // CT1103: the prepare-hook env plus the authoritative host-access token.
       env: this.turnEnv,
       mcpServers: this.resolvedMcpServers,
       secretEnv: this.secretEnv,
       turnControlServer,
-      // CT238: this turn's conversation, forwarded as the active-conversation
-      // header so a cross-thread post/spawn stamps its origin.
+      // Sent as the active-conversation header so a cross-conversation post
+      // stamps its origin.
       activeConversationId: payload.conversationId,
-      // Workspace coordinate retained in the compatible TurnRequest envelope.
       workspaceId,
-      // CT289: the operator's auto-memory escape hatch (machine-local), when set.
+      // The operator's machine-local auto-memory escape hatch, when set.
       ...this.opts.local.claudeCode ? { claudeCode: this.opts.local.claudeCode } : {}
     });
   }
@@ -10836,8 +10569,8 @@ var TurnExecution = class {
     if (this.opts.claudeCodeAvailable?.() ?? true) {
       this.containment = createTurnContainment(this.turnId, {
         log: (msg, meta) => turnLog.debug(meta ?? {}, msg),
-        // CT1679: a group outside the runner's own is reported, so a launcher
-        // can stop it if the runner dies without reaping it.
+        // A group outside the runner's own is reported, so a launcher can stop
+        // it if the runner dies without reaping it.
         ...this.opts.inRunner?.onProcessGroup ? { onProcessGroup: this.opts.inRunner.onProcessGroup } : {}
       });
       const containment = this.containment;
@@ -10858,8 +10591,8 @@ var TurnExecution = class {
       const serverUrl = this.opts.opencodeServerUrl;
       adapters.push(
         createOpencodeAdapter(
-          // CT1679: the transport's per-server turn mutex is per process; in a
-          // runner the turn also holds the device-wide lock every runner shares.
+          // The transport's per-server turn mutex is per process; in a runner the
+          // turn also holds the device-wide lock every runner shares.
           this.opts.inRunner ? {
             transport: this.opts.inRunner.opencodeTransport(serverUrl),
             onWarn
@@ -10906,7 +10639,7 @@ var TurnExecution = class {
           kind: "runtime_notice",
           turnId,
           parentMessageId: payload.messageId,
-          // CT1677: the notice is written by this attempt's source, like its speech.
+          // Written by this attempt's source, like its speech.
           ...this.executionSourceId !== void 0 ? { executionSourceId: this.executionSourceId } : {}
         });
       } catch (postErr) {
@@ -10920,16 +10653,13 @@ var TurnExecution = class {
       throw this.concluded(`runtime_unavailable:${err.runtime}`);
     }
   }
-  // The adapter refused to resume this pair's stored session and is starting a
-  // fresh one. The request it holds was composed for a session that had the
-  // conversation so far — the read is what landed since the cursor, the
-  // agent's own words left out because the session held them. A fresh session
-  // holds none of it, so fetch the context again as a first turn on an empty
-  // session (the whole conversation, own words included, the first-turn
-  // material) and hand the adapter that to run on — before it speaks or acts.
-  // The lease already granted stands; the read reaches at least its mark. A
-  // fetch that fails returns null and the adapter falls back to the request
-  // it has, flagged degraded, so the server rewinds the cursor at settle.
+  // The adapter refused to resume the stored session and is starting fresh. The
+  // request it holds assumed the session had the conversation so far (only what
+  // landed since the cursor, the agent's own words left out); a fresh session
+  // has none of it. So refetch as a first turn on an empty session and hand the
+  // adapter that, before it speaks or acts. The granted lease stands. A failed
+  // fetch returns null: the adapter runs the request it has, flagged degraded,
+  // and the server rewinds the cursor at settle.
   async freshRequest(reason) {
     const { payload, turnId, turnLog } = this;
     try {
@@ -10940,9 +10670,8 @@ var TurnExecution = class {
         false,
         true,
         void 0,
-        // CT1657: the turn's abort. This recompose happens mid-run with the
-        // adapter waiting on it, so a Stop here must end the wait rather than
-        // hold the turn open for the rest of the retry schedule.
+        // The adapter is waiting on this, so a Stop must end the wait rather
+        // than hold the turn open for the rest of the retry schedule.
         this.abortController.signal
       );
       turnLog.debug(
@@ -10994,19 +10723,17 @@ var TurnExecution = class {
       conversationId: payload.conversationId,
       agentId: payload.agentId,
       turnId,
-      // CT113: the message this turn answers — passed back on every commit so
-      // the reply records the Q→A edge the in-process dispatcher stamps directly.
+      // The message this turn answers, on every commit so the reply records the
+      // Q→A edge.
       parentMessageId: payload.messageId,
       signal: abortController.signal,
       log: turnLog,
       nextSeq: this.nextSeq,
       spoke: this.resumedSpoke,
-      // CT1677: admitted by now, so this is the source the model's work runs on.
+      // Admitted by now, so this is the source the model's work runs on.
       ...this.executionSourceId !== void 0 ? { executionSourceId: this.executionSourceId } : {},
-      // CT1292: a commit that didn't land may mean this turn's lease is gone.
-      // `noteCommitFailed` is a field slot the lease watchdog fills when it
-      // arms (it starts as a no-op) — the committer only fires it from inside
-      // the adapter loop, which runs after the watchdog has replaced it.
+      // A commit that didn't land may mean the lease is gone; see
+      // `noteCommitFailed`.
       onCommitFailed: (err) => this.noteCommitFailed(err)
     });
     const usesHttpTurnControl = turnRuntime === "codex" || turnRuntime === "opencode";
@@ -11110,9 +10837,9 @@ var TurnExecution = class {
                 workspaceId,
                 payload.conversationId,
                 payload.agentId,
-                // CT1680: named for its turn, which a runner credential
-                // requires once its start is admitted; the server then binds
-                // the capture to that turn's attempt rather than the pair's.
+                // Named for its turn, which a runner credential requires once
+                // admitted; the server binds the capture to that turn's attempt
+                // rather than the pair's.
                 { agentSessionId: event.state, turnId }
               );
             } catch (err) {
@@ -11217,9 +10944,7 @@ var TurnExecution = class {
       }
       const body = {
         activeRunStartedAt: null,
-        // CT277: the server keys the turn-end metadata UPDATE (ended_at + tokens)
-        // off this turn id, so the settle PATCH must carry it — the start PATCH
-        // isn't enough. Always sent (every settle closes a real turn).
+        // The server keys the turn-end metadata (ended_at, tokens) off this id.
         turnId
       };
       if (o.turnUsage) {
@@ -11387,11 +11112,11 @@ var Dispatcher = class {
     this.aborts = opts.aborts ?? /* @__PURE__ */ new Map();
   }
   opts;
-  // CT1288: keyed (conversation|agent) → per-TURN controllers. Stop is
-  // pair-scoped and must reach every live loop for the pair.
+  // (conversation|agent) → per-TURN controllers. Stop is pair-scoped and must
+  // reach every live loop for the pair.
   aborts;
-  // CT1109: pairs already told "your session couldn't be saved" — the notice is
-  // once per (conversation, agent), while the rejection repeats every turn.
+  // Pairs already told their session couldn't be saved: the notice is once per
+  // pair, while the rejection repeats every turn.
   sessionWriteNotified = /* @__PURE__ */ new Set();
   notifyStart(info) {
     try {
@@ -11408,11 +11133,6 @@ var Dispatcher = class {
   // The supervisor supplies a stable turnId on both fresh and resumed dispatch.
   // resumed is separate: only replay seeds sequence/speech recovery from the
   // prior span. A direct caller omitting turnId gets a fresh id.
-  //
-  // CT1261: a short `handle` creates a `TurnExecution` and runs it. The
-  // supervisor seam hands the execution exactly the three cross-turn duties —
-  // the abort registry, the session-write notice latch, the observer — and
-  // nothing else.
   async handle(payload, opts = {}) {
     const key = runKey(payload.conversationId, payload.agentId);
     const supervisor = {
@@ -11458,8 +11178,8 @@ var Dispatcher = class {
     }
     return new TurnExecution(this.opts, supervisor, payload, opts).run();
   }
-  // SJ383: cancel a specific (conversation, agent) run if one is in flight in
-  // THIS companion process. Returns true if an in-flight run was aborted.
+  // Cancel a (conversation, agent) run in flight in THIS process. True if one
+  // was aborted.
   cancel(conversationId, agentId) {
     const key = runKey(conversationId, agentId);
     const pair = this.aborts.get(key);
@@ -13156,7 +12876,7 @@ var Outbox = class {
   }
   workspaceId;
   log;
-  // Resolved lazily (per call, like cursor.ts) so tests that swap HOME between
+  // Resolved lazily (per call) so tests that swap HOME between
   // cases route writes at the right tmpdir.
   dir() {
     return join20(runnerStateDir(), "outbox", encodeURIComponent(this.workspaceId));
@@ -13222,7 +12942,7 @@ var Outbox = class {
     );
     return entries;
   }
-  // CT1380: the highest `seq` this turn has queued but not yet delivered — the
+  // The highest `seq` this turn has queued but not yet delivered — the
   // half of a resumed turn's seq floor the SERVER CANNOT SEE. A commit that
   // failed transiently before the crash is sitting in this directory with its
   // seq already spent, and the restart's drain is fire-and-forget
@@ -13446,24 +13166,20 @@ var CompanionSupervisor = class {
   config;
   log;
   hub;
-  // CT1379: the bundled-executable resolver — the execution-presence half of both
-  // routing gates. Synchronous and cheap (a module resolve plus a stat), so unlike
-  // the CLI probes it needs no boot-frozen fallback: a caller that asks before the
-  // first harness refresh simply resolves now.
+  // The execution-presence half of both routing gates. Synchronous and cheap (a
+  // module resolve plus a stat), so a caller before the first harness refresh
+  // simply resolves now.
   resolveBundled;
-  // CT1379: the last bundled status LOGGED per harness, so a missing binary is
-  // reported at startup and on each healthy↔missing transition rather than on
-  // every 30s beat (the CT484 latch pattern, per runtime).
+  // The last bundled status LOGGED per harness, so a missing binary is reported
+  // at startup and on each healthy↔missing transition, not every beat.
   loggedBundledStatus = /* @__PURE__ */ new Map();
-  // CT571: the probed per-harness versions, reported on each heartbeat manifest.
-  // CT586: no longer boot-frozen — the per-heartbeat harness re-probe refreshes
-  // it, so a harness updated mid-run reports its new version without a restart.
+  // Refreshed by the per-heartbeat re-probe, so a harness updated mid-run
+  // reports its new version without a restart.
   harnessVersions;
-  // CT586: the latest harness detection signals (presence + reachability), probed
-  // on the heartbeat cadence + on demand. Feeds BOTH the heartbeat manifest's
-  // live presence and the Companion's Harnesses surface off ONE source, so the UI
-  // can never disagree with what the manifest advertises. Null until the first
-  // probe (the heartbeat then falls back to the boot `claudeCode`).
+  // The latest harness signals (presence, reachability), probed on the heartbeat
+  // cadence and on demand. ONE source for both the manifest and the Harnesses
+  // surface, so the UI never disagrees with what is advertised. Null until the
+  // first probe.
   harnessSignals = null;
   // Fresh per attempt, never the cached heartbeat signal: installing a harness
   // between attempts must be observed immediately.
@@ -13476,8 +13192,8 @@ var CompanionSupervisor = class {
   unrunnableRetryDelaysMs;
   deviceApi = null;
   deviceSub = null;
-  // ACC8: whether the device stream is open, which is what every workspace's
-  // link on the dashboard reports.
+  // Whether the device stream is open, which is what every workspace's link on
+  // the dashboard reports.
   deviceConnected = false;
   recoveryChecked = false;
   recovering = false;
@@ -13489,8 +13205,7 @@ var CompanionSupervisor = class {
   pollTimer = null;
   refreshing = false;
   stopped = false;
-  // CT484: latch so the companion/server version-skew warning is logged once, not
-  // on every 30s heartbeat.
+  // The version-skew warning is logged once, not every heartbeat.
   versionSkewWarned = false;
   // This device's id, captured from the heartbeat / assignments response. The SSE
   // router uses it to tell a dispatch addressed to THIS device (a freshly-assigned
@@ -13500,12 +13215,12 @@ var CompanionSupervisor = class {
   // The in-flight assignments pull, exposed so a caller that needs fresh data
   // (pull-on-miss) can `await` the running pull rather than racing past it.
   inFlightRefresh = null;
-  // CT566: device-global connector-health memory — every dispatcher records its
-  // turn's classified outcome here (per runtime); the heartbeat echoes it so the
-  // server's per-connector quota state survives a restart/race.
+  // Device-global connector-health memory: every dispatcher records its turn's
+  // classified outcome per runtime; the heartbeat echoes it so the server's
+  // quota state survives a restart or race.
   connectorHealth = new ConnectorHealthStore();
-  // ACC10: which dispatches this process is running, so the copy of a frame that
-  // arrives on the other stream doesn't run the turn a second time.
+  // Which dispatches this process is running, so a redelivered frame doesn't
+  // run the turn a second time.
   claims = new DispatchClaims();
   constructor(opts) {
     this.config = opts.config;
@@ -13526,10 +13241,10 @@ var CompanionSupervisor = class {
     }
     this.latchBootBundledState();
   }
-  // CT1681: what a runner container said it can run, probed once at start;
-  // null until then, and when no container could be started.
+  // What a runner container said it can run, probed once at start; null until
+  // then, and when no container could be started.
   runnerImage = null;
-  // CT1681: the companion every container mounts — this one's own install.
+  // The companion every container mounts: this one's own install.
   runnerCompanion() {
     return companionSource({
       configured: this.config.runners?.docker?.companionDir,
@@ -13641,10 +13356,7 @@ var CompanionSupervisor = class {
     this.pollTimer = setInterval(() => void this.refreshAssignments(), ASSIGNMENTS_POLL_MS);
     this.pollTimer.unref?.();
   }
-  // The set of SSE subscriber `finished` promises — start.ts awaits these to
-  // keep the foreground process alive. With the poll loop running there's always
-  // at least the loops keeping the event loop alive; the SSE promises let a
-  // clean teardown resolve.
+  // start.ts awaits these; they resolve on a clean teardown.
   finishedPromises() {
     return [...this.deviceSub ? [this.deviceSub.finished] : []];
   }
@@ -13672,39 +13384,26 @@ var CompanionSupervisor = class {
         bootId,
         version: COMPANION_VERSION,
         exposedSecretNames: store.names(),
-        // Report each runtime only when this device can actually run it:
-        // CT1379 claude-code and codex when the SDK's own bundled binary is there
-        // and the user asked for the harness, CT270 opencode when the operator
-        // configured an `opencode serve`.
+        // Each runtime only when this device can actually run it.
         manifest: buildCompanionManifest({
-          // CT1082/CT1379: connected AND launchable. Execution presence is the
-          // live bundled-binary resolution (refreshed on this beat), consent is
-          // the user's `claudeCode.enabled`. Claude Code rides neither alone.
+          // Consented (`claudeCode.enabled`) AND launchable (the live bundled
+          // binary). Neither alone.
           claudeCode: this.claudeCodeOffered(),
           opencode: !!this.config.opencode?.serverUrl,
-          // CT481/CT1379: advertise codex when the operator enabled it AND its
-          // vendored binary is there. The enable flag alone used to be enough,
-          // which is how a device with a half-installed 331 MB platform package
-          // advertised a runtime that could not start.
+          // Enabled AND its vendored binary present: a half-installed 331 MB
+          // platform package otherwise advertises a runtime that cannot start.
           codex: this.codexOffered(),
-          // CT1379: and say WHY when an asked-for harness is absent from the list
-          // above. Diagnostic only — the server never routes on it — and always
+          // WHY an asked-for harness is absent above. Diagnostic only, and always
           // sent, so an empty array clears a previously reported issue.
           runtimeIssues: this.runtimeIssues(),
-          // CT571/CT586: each runtime's `version` from the latest harness probe
-          // (fail-soft to null). Informational only — the server matches on name.
+          // Informational only; the server matches on name.
           versions: this.harnessVersions,
-          // CT1681: shown on the device page.
+          // Shown on the device page.
           ...runnersEnabled(this.config) ? { runner: this.runnerManifest() } : {}
         }),
-        // CT566: echo the last classified credential state per runtime, when the
-        // companion has seen any. Omitted (undefined) until the first observed
-        // failure/heal, so a fresh companion's beat is unchanged and the server's
-        // manifest synthesis (status-less rows) still runs.
+        // Omitted until the first observed failure or heal, so the server's
+        // status-less manifest synthesis still runs for a fresh companion.
         ...connectorReports.length > 0 ? { connectors: connectorReports } : {},
-        // CT584: include enumerated models only when the probe SUCCEEDED (non-null).
-        // A null (probe failed / no opencode) omits the field, and the server then
-        // leaves this device's stored availability untouched.
         ...opencodeModels !== null ? { models: opencodeModels } : {}
       });
       this.hub.setDevice({ deviceId: res.deviceId });
@@ -13719,11 +13418,8 @@ var CompanionSupervisor = class {
       );
     }
   }
-  // CT484: belt-and-suspenders beside shipping the companion in lockstep inside the
-  // artifact — if the server reports a build version that differs from this
-  // companion's, warn loudly (once). This is exactly the skew that bit the M1 walk:
-  // an npm-pinned companion lagging a from-develop server. The elimination (bundled
-  // companion) makes it match by construction; this catches a companion run out of band.
+  // Warn once when the server's build version differs from this companion's: an
+  // npm-pinned companion lagging the server is the usual cause of odd failures.
   checkVersionSkew(serverVersion) {
     if (this.versionSkewWarned) return;
     if (!serverVersion || serverVersion === COMPANION_VERSION) return;
@@ -13920,10 +13616,9 @@ var CompanionSupervisor = class {
       `Stopped running ${runner.displayName} (unassigned)`
     );
   }
-  // CT1379: can this machine LAUNCH the harness — is the SDK's own bundled
-  // executable there? Live (the per-beat re-resolve), falling back to resolving
-  // right now before the first refresh lands. Execution presence ONLY; consent is
-  // the caller's half.
+  // Can this machine LAUNCH the harness — is the SDK's bundled executable there?
+  // The per-beat result, or resolved now before the first refresh. Execution
+  // presence ONLY; consent is the caller's half.
   bundledStatus(runtime) {
     const cached2 = runtime === "codex" ? this.harnessSignals?.codexBundled : this.harnessSignals?.claudeBundled;
     return cached2 ?? this.resolveBundled(runtime).status;
@@ -13934,23 +13629,19 @@ var CompanionSupervisor = class {
   bundledResolution(runtime) {
     return this.resolveBundled(runtime);
   }
-  // CT1082/CT1379: does this device OFFER claude-code — connected by its user, and
-  // able to start the binary a turn runs? The ONE signal both the heartbeat
-  // manifest and the dispatcher's adapter registry read, so what the device
-  // advertises and what it can select can't disagree (the CT833 invariant, with
-  // consent in front of it and the real executable underneath it).
+  // Does this device OFFER claude-code — connected by its user, and able to start
+  // the binary a turn runs? The ONE signal both the heartbeat manifest and the
+  // adapter registry read, so what the device advertises and what it can select
+  // can't disagree.
   claudeCodeOffered() {
     return isClaudeCodeConnected(this.config) && this.bundledStatus("claude-code") === "present";
   }
-  // CT1379: and the same question for codex, which until now was the enable flag
-  // alone — so an enabled device with no vendored binary advertised a runtime it
-  // could not start. Same shape as Claude Code, same predicate on both sides.
+  // The same question for codex: enabled AND its vendored binary present.
   codexOffered() {
     return isCodexEnabled(this.config) && this.bundledStatus("codex") === "present";
   }
-  // CT1379: the manifest's diagnostic half, derived from the same two facts as the
-  // two predicates above so an issue and an advertisement can never both be made
-  // for one harness.
+  // Derived from the same two facts as the predicates above, so an issue and an
+  // advertisement are never both made for one harness.
   runtimeIssues() {
     return runtimeIssuesFor({
       claudeCode: {
@@ -13960,26 +13651,16 @@ var CompanionSupervisor = class {
       codex: { intended: isCodexEnabled(this.config), bundled: this.bundledStatus("codex") }
     });
   }
-  // CT1379: a missing binary is reported ONCE, and again only when the answer
-  // CHANGES — with the runtime, the platform/architecture and the resolution
-  // result, which is enough to find the occurrence in `companion.log` without a
-  // repro and carries nothing that could be a credential or a vendor's output.
-  //
-  // Two things this deliberately does NOT do (Codo's review, blocking finding #2):
+  // A missing binary is reported ONCE, and again only when the answer CHANGES,
+  // with runtime, platform/arch and status: enough to find it in `companion.log`
+  // without a repro, and nothing that could be a credential or vendor output.
   //
-  //   - It does not re-announce the state the device booted in. `warnAboutHarnessReadiness`
-  //     already said that on stderr at startup, in the specified words, at the one
-  //     moment a person is watching a terminal — and the `--daemon` launcher runs
-  //     that preflight in the FOREGROUND for exactly that reason, because the
-  //     child's output goes to a file. The boot state is latched in the
-  //     constructor, so the first refresh reports nothing new; it lands here as a
-  //     debug record instead, present for diagnosis without competing for
-  //     attention with the warning the operator already read.
-  //   - It does not report a transition in generic prose. A binary that goes
-  //     missing at 3am is the case the operator will actually meet, and a line
-  //     that says only "binary is missing" leaves them with no repair and no
-  //     restart instruction. Transitions carry the specified copy verbatim — the
-  //     same sentence the startup path prints.
+  //   - The boot state is not re-announced: `warnAboutHarnessReadiness` said it
+  //     on stderr at startup, when a person is watching (the `--daemon` launcher
+  //     runs that preflight in the FOREGROUND because the child logs to a file).
+  //     It is latched in the constructor and recorded at debug.
+  //   - A transition carries the same repair copy the startup path prints, not
+  //     generic prose: a binary missing at 3am needs the repair and the restart.
   logBundledTransitions() {
     for (const runtime of ["claude-code", "codex"]) {
       const intended = runtime === "codex" ? isCodexEnabled(this.config) : isClaudeCodeConnected(this.config);
@@ -14002,9 +13683,8 @@ var CompanionSupervisor = class {
         this.log.debug(meta, "companion: bundled harness binary is missing (harness not in use)");
     }
   }
-  // CT1379: the boot state, latched so the first refresh reports no news, and
-  // recorded once as evidence. Runs in the constructor — the resolve is a module
-  // lookup plus a stat, so it costs nothing and needs no await.
+  // The boot state, latched so the first refresh reports no news, and recorded
+  // once as evidence. Synchronous: a module lookup plus a stat.
   latchBootBundledState() {
     for (const runtime of ["claude-code", "codex"]) {
       const resolution = this.resolveBundled(runtime);
@@ -14022,35 +13702,34 @@ var CompanionSupervisor = class {
       );
     }
   }
-  // CT1679: the locks every runner on this device shares, held here.
+  // The locks every runner on this device shares.
   runnerLocks = new DeviceLocks();
-  // CT1679: `runners.sandbox`, checked against this host once. A host that
-  // can't make the sandbox says so once and runs its turns unwrapped.
+  // `runners.sandbox`, checked against this host once. A host that can't make
+  // the sandbox says so once and runs its turns unwrapped.
   sandboxUsable;
   sandboxHost = {
     osSandboxUsable: () => this.sandboxUsable ??= osSandboxUsable(this.log)
   };
-  // CT1684: `runners.policy`, parsed once. An invalid one is kept as the
-  // error, which every sandboxed turn is refused with.
+  // `runners.policy`, parsed once. An invalid one is kept as the error, which
+  // every sandboxed turn is refused with.
   parsedSandboxPolicy;
   sandboxPolicy() {
     this.parsedSandboxPolicy ??= parseSandboxPolicy(this.config.runners?.policy);
     return this.parsedSandboxPolicy;
   }
-  // CT1691: the walk for other companions' stores, run off the turn path.
+  // The walk for other companions' stores, run off the turn path.
   storeWatch;
   companionStores() {
     this.storeWatch ??= companionStoreWatch(this.log);
     return this.storeWatch;
   }
-  // CT1693: the sandbox one agent's turns run under — its `agents` row, then
-  // the device's. Resolved from the current config every time it's asked, so
-  // a reload changes it; only the host probe is kept.
+  // The sandbox one agent's turns run under: its `agents` row, then the
+  // device's. Resolved from the current config on every ask, so a reload
+  // changes it; only the host probe is kept.
   runnerSandboxFor(row) {
     return runnerSandboxFor(this.config, row, this.sandboxHost);
   }
-  // CT1693: what the heartbeat says about this device's runners, resolved
-  // against the agents it runs right now.
+  // Resolved against the agents this device runs right now.
   runnerManifest() {
     const agents = [...this.workspaces.values()].flatMap(
       (wr) => [...wr.agents.values()].map((agent) => ({
@@ -14064,7 +13743,7 @@ var CompanionSupervisor = class {
       ...runnerSandboxReport(this.config, agents, this.sandboxHost)
     };
   }
-  // CT1679: one provider for the device, built on first use.
+  // One provider for the device, built on first use.
   runnerProvider() {
     this.providerForRunners ??= this.dockerRunners() ? this.createDockerRunners() : createLocalProcessProvider();
     return this.providerForRunners;
@@ -14106,8 +13785,7 @@ var CompanionSupervisor = class {
       log: this.log
     });
   }
-  // CT1681: the runner command for this device's provider: the image's own
-  // companion in a container, this process's otherwise.
+  // The image's own companion in a container, this process's otherwise.
   runnerCommandFor() {
     if (this.runnerCommand) return this.runnerCommand;
     return this.dockerRunners() ? ["cabane-companion", "run-turn"] : selfRunnerCommand();
@@ -14139,36 +13817,20 @@ var CompanionSupervisor = class {
       aborts: ctx.aborts,
       runConfig: ctx.runConfig,
       log: this.log.child({ agentName: ctx.agentDisplayName ?? ctx.agentUsername }),
-      // CT833: register the claude-code adapter only when this device actually
-      // offers claude-code — read per turn (not captured here), so a harness
-      // installed or connected after boot works on the next turn exactly as it
-      // appears on the next beat. CT1082: "offers" means connected as well as
-      // runnable, so a disconnected harness can't be selected either.
-      // CT1379: and the same for the bundled binary — the predicate is shared with
-      // the heartbeat above, so a runtime advertised by one and refused by the
-      // other is not expressible.
+      // Read PER TURN off the heartbeat's own predicates, so a harness installed
+      // or connected after boot works on the next turn exactly as it appears on
+      // the next beat, and a runtime advertised by one and refused by the other
+      // is not expressible.
       claudeCodeAvailable: () => this.claudeCodeOffered(),
-      // CT270: the opencode server URL (operator-configured), when this device
-      // offers the opencode runtime. Threaded so an opencode turn selects the
-      // opencode adapter; unset leaves the device claude-code-only.
       ...this.config.opencode?.serverUrl ? { opencodeServerUrl: this.config.opencode.serverUrl } : {},
-      // CT481: register the codex adapter when this device offers codex; a miss
-      // leaves an `openai/…` turn to fail loudly (no silent claude-code fallback).
-      // CT1379: read PER TURN, like claude-code above, and off the same predicate
-      // the heartbeat uses — it was captured here at dispatcher-construction time
-      // from the enable flag alone, so a device could register an adapter for a
-      // binary it did not have and keep it registered after the binary came back.
       codexAvailable: () => this.codexOffered(),
-      // CT556: per-turn timeout watchdog windows, from the companion's own env
-      // (`AGENT_IDLE_TIMEOUT_MS` / `AGENT_TOTAL_TIMEOUT_MS`). Unset → the
-      // dispatcher's baked-in defaults (CT1503: 15 min idle / 6h total). An
-      // override set here still wins, and is deliberately not validated against
-      // the tool ceilings it may reorder — see DEFAULT_AGENT_IDLE_TIMEOUT_MS.
+      // Unset uses the dispatcher's defaults. An override is deliberately not
+      // validated against the tool ceilings it may reorder; see
+      // DEFAULT_AGENT_IDLE_TIMEOUT_MS.
       ...positiveIntEnv("AGENT_IDLE_TIMEOUT_MS") !== void 0 ? { idleTimeoutMs: positiveIntEnv("AGENT_IDLE_TIMEOUT_MS") } : {},
       ...positiveIntEnv("AGENT_TOTAL_TIMEOUT_MS") !== void 0 ? { totalTimeoutMs: positiveIntEnv("AGENT_TOTAL_TIMEOUT_MS") } : {},
       observer: this.hub.observerFor(ctx.workspaceId, ctx.agentId, ctx.workspaceSlug),
       transcriptDir: transcriptsDir(),
-      // CT566: the shared connector-health memory the turn records into on settle.
       connectorHealth: this.connectorHealth,
       ...runnersEnabled(this.config) ? {
         runner: {
@@ -14192,11 +13854,10 @@ var CompanionSupervisor = class {
     this.workspaces.delete(workspaceId);
     this.hub.removeWorkspace(workspaceId);
   }
-  // ---- SSE event routing (per workspace, BY agentId) ----
-  // ACC10: the device stream's frames — dispatch and cancel, addressed to this
-  // device and authenticated as it. ACC8: the only stream this companion opens.
-  // It keeps no cursor: it replays what is still offered on every connect
-  // instead of resuming from a `Last-Event-ID`.
+  // ---- SSE event routing (BY agentId) ----
+  // Dispatch and cancel, addressed to this device. The stream keeps no cursor:
+  // it replays what is still offered on every connect instead of resuming from
+  // a `Last-Event-ID`.
   async handleDeviceMessage(ev) {
     const wire = this.parseFrame(ev);
     if (!wire) return;
@@ -14232,9 +13893,9 @@ var CompanionSupervisor = class {
       return null;
     }
   }
-  // ACC10: the dedupe gate. A reconnect replays every dispatch still offered,
-  // including one whose turn is already running here; the first copy runs the
-  // turn and a later one waits for it and then does nothing.
+  // A reconnect replays every dispatch still offered, including one whose turn
+  // is already running here; the first copy runs it and a later one waits for
+  // it and then does nothing.
   //
   // A cancel needs no gate: `dispatcher.cancel` on an already-aborted run is a
   // no-op that reports `false`, so a second copy is inert.
@@ -14250,8 +13911,6 @@ var CompanionSupervisor = class {
       if (claim) this.claims.release(wire.id);
     }
   }
-  // Everything below here is the routing as it was: it takes a frame and knows
-  // nothing about which stream carried it.
   async routeFrame(wr, wire) {
     if (wire.type === "device:cancel_requested") {
       const payload2 = {
@@ -14317,17 +13976,12 @@ var CompanionSupervisor = class {
     await tail;
     if (wr.chains.get(chainKey) === tail) wr.chains.delete(chainKey);
   }
-  // CT1146: tell the server this device cannot run a dispatch it was addressed to.
-  //
+  // Tell the server this device cannot run a dispatch it was addressed to.
   // Returns whether the report LANDED. The server checks the recorded dispatch
-  // destination even if the agent's assignment has moved. Reporting promptly
-  // explains the roster miss; the thirty-minute unanswered-offer deadline is
-  // only the backstop when no report lands.
+  // destination even if the assignment has moved.
   //
-  // Bounded retry, because the common failure is transient (a 503 mid-deploy, a
-  // dropped socket) and one more attempt a second later usually lands. Bounded
-  // hard — this runs inline on the event loop, and an unbounded wait here would
-  // wedge the workspace's whole stream.
+  // Retried, because the common failure is transient (a 503 mid-deploy), and
+  // bounded hard: this runs inline, and an unbounded wait would wedge the stream.
   async reportUnrunnableDispatch(workspaceId, payload) {
     if (!this.deviceApi) return false;
     let lastErr;
@@ -14367,9 +14021,8 @@ var CompanionSupervisor = class {
     );
     return false;
   }
-  // CT1680: a runner is gone without having settled its turn. Same bounded
-  // retry as the unrunnable report above, on the device credential, which is
-  // the one the launcher still holds whatever became of the runner.
+  // A runner is gone without having settled its turn. Same bounded retry, on the
+  // device credential, which the launcher holds whatever became of the runner.
   async reportRunnerGone(report) {
     if (!this.deviceApi) return;
     let lastErr;
@@ -14394,12 +14047,9 @@ var CompanionSupervisor = class {
       "Couldn't tell Cabane a turn's runner stopped; its credential expires on its own."
     );
   }
-  // Pull-on-miss for the assignment-change race: a dispatch arrived for an agent
-  // we don't yet run. If it's addressed to THIS device, the assignment just
-  // changed under us (the poll hasn't caught it) — force a fresh assignments pull
-  // and return the now-live runner. Returns undefined when the dispatch isn't for
-  // this device, or the agent still isn't ours after pulling (a genuine
-  // not-ours dispatch) — the caller then settles and ignores it as before.
+  // Pull-on-miss: a dispatch addressed to THIS device for an agent we don't run
+  // yet means the assignment changed under us. Undefined when it isn't for this
+  // device, or the agent still isn't ours after the pull.
   async recoverRacedAgent(wr, payload) {
     if (!this.deviceId || payload.deviceId !== this.deviceId) return void 0;
     if (this.refreshing && this.inFlightRefresh) await this.inFlightRefresh;
@@ -14440,9 +14090,8 @@ var CompanionSupervisor = class {
         };
         const tail = this.runDispatch(
           wr,
-          // No frame delivered this one — it came off `/runs` — so there is no
-          // dispatch id to dedupe on. The `recoveredTurns` set above is this
-          // path's own guard.
+          // Off `/runs`, not a frame, so no dispatch id to dedupe on;
+          // `recoveredTurns` is this path's guard.
           "",
           payload,
           agent,
@@ -14464,9 +14113,7 @@ var CompanionSupervisor = class {
       this.recovering = false;
     }
   }
-  // One turn: the SJ516 F7 / CT26 skip-vs-resume dedupe, the dispatch, then
-  // the console summary. Mirrors the old per-workspace `handleEvent`, now
-  // scoped to one agent.
+  // One turn: the skip-vs-resume dedupe, the dispatch, then the console summary.
   async runDispatch(wr, dispatchId, payload, agent, recoveredTurnId) {
     const workspaceId = wr.workspaceId;
     if (dispatchId && hasDispatched(workspaceId, dispatchId)) {
@@ -14551,7 +14198,7 @@ var CompanionSupervisor = class {
       );
     }
   }
-  // ---- per-agent outbox drain scheduler (CT25) ----
+  // ---- per-agent outbox drain scheduler ----
   makeDrain(api, agentId) {
     let drainTimer;
     let drainDelay = DRAIN_BASE_MS;
@@ -14620,19 +14267,16 @@ var CompanionSupervisor = class {
     saveConfig(next);
     configureLogger(this.log, next);
   }
-  // ---- harnesses (CT586) ----
-  // Probe all three harnesses, cache the signals + versions, and push the derived
-  // per-harness snapshot to the hub (which flips the Companion's Harnesses surface
-  // over SSE). Fail-soft by construction — `probeHarnessSignals` never throws — but
-  // wrapped anyway so a harness refresh can never take a heartbeat down. Called on
-  // the heartbeat cadence (fresh presence for the manifest + UI) and on demand.
+  // ---- harnesses ----
+  // Probe all three harnesses, cache signals and versions, and push the snapshot
+  // to the hub. `probeHarnessSignals` never throws, but this is wrapped anyway so
+  // a refresh can never take a heartbeat down.
   async refreshHarnessStatuses(presence = {}) {
     try {
       const signals = await probeHarnessSignals(this.config, {
         probePresence: this.probePresence,
         presence,
-        // CT1379: the bundled executables are resolved on the same cadence as the
-        // CLI probes, through the supervisor's seam so a test pins the host fact.
+        // Through the supervisor's seam, so a test pins the host fact.
         resolveBundled: this.resolveBundled
       });
       this.harnessSignals = signals;
@@ -14655,11 +14299,10 @@ var CompanionSupervisor = class {
   async recheckHarnesses() {
     await this.refreshHarnessStatuses();
   }
-  // CT1085 §1 step 3: beat NOW and wait for it to land. `start` calls this
-  // between bringing the runtime up and asking the person anything, so the
-  // browser's connect step is already showing what this machine has ("your
-  // terminal is asking") rather than sitting blank while the terminal blocks on
-  // an answer. Coalesces with an in-flight beat rather than stacking a second.
+  // Beat NOW and wait for it to land. `start` calls this before asking the
+  // person anything, so the browser's connect step already shows what this
+  // machine has rather than sitting blank while the terminal waits on an answer.
+  // Coalesces with an in-flight beat.
   async heartbeatNow() {
     if (this.inFlightHeartbeat) {
       await this.inFlightHeartbeat;
@@ -14668,35 +14311,25 @@ var CompanionSupervisor = class {
     this.kickHeartbeat();
     if (this.inFlightHeartbeat) await this.inFlightHeartbeat;
   }
-  // CT1085: the config as it stands right now — after any `enableHarness` write.
-  // The control socket's connect handler needs it to run the shake-out check
-  // against the URL/flag that was just persisted, not the one this process booted
-  // with.
+  // The config as it stands now, after any `enableHarness` write: the control
+  // socket's shake-out check needs what was just persisted, not the boot config.
   currentConfig() {
     return this.config;
   }
-  // Friendly enable for the config-driven harnesses — flip the flag the app owns in
-  // `~/.cabane/config.json`, no hand-edited JSON. It never installs a binary and
-  // never drives a login (BYO — Decided).
+  // Enable a config-driven harness by flipping the flag the app owns in
+  // `~/.cabane/config.json`. Never installs a binary or drives a login (BYO).
   //
-  // CT1379: this records INTENT; it does not by itself expose anything. A harness
-  // is advertised only when the user asked for it AND the SDK's own bundled binary
-  // resolves, so a successful enable on a companion whose optional dependency
-  // never installed leaves the device advertising nothing — correctly, and with
-  // the Harnesses surface saying why. Read every "expose" below as "record the
-  // half of the answer the user owns".
-  //   - claude-code (CT1082): set `claudeCode.enabled`, after checking `claude` is
-  //     on PATH. This is the callable the terminal offer ("We found Claude Code.
-  //     Connect it? [Y/n]") and the web pairing flow both wire to.
-  //   - codex: set `codex.enabled` after checking `codex` is on PATH (the CLI +
-  //     `codex login` remain the user's).
-  //   - opencode: set `opencode.serverUrl` — but ONLY after health-probing the URL,
-  //     so we never advertise a serve that isn't there. An unreachable URL is a
-  //     typed failure the UI shows in place, not a silent bad write.
-  // On success, persist, re-probe, and beat immediately, so a runtime that IS
-  // launchable starts taking turns at once rather than on the next tick — and one
-  // that isn't reports its issue just as promptly. Returns a typed outcome (never
-  // throws for a reachable/valid input).
+  // This records INTENT, the user's half: a harness is advertised only when also
+  // its bundled binary resolves, so an enable on a companion whose optional
+  // dependency never installed advertises nothing, and the Harnesses surface
+  // says why.
+  //   - claude-code: `claudeCode.enabled`, after a presence check. The terminal
+  //     offer and the web pairing flow both call this.
+  //   - codex: `codex.enabled`, after a presence check (login stays the user's).
+  //   - opencode: `opencode.serverUrl`, ONLY after health-probing the URL; an
+  //     unreachable one is a typed failure shown in place.
+  // On success: persist, re-probe and beat at once, so the answer is true in
+  // Cabane promptly either way. Never throws for a valid input.
   async enableHarness(input) {
     let next;
     let checkedPresence = null;
@@ -14747,9 +14380,8 @@ var CompanionSupervisor = class {
     return { ok: true };
   }
   // Re-create every running agent's Dispatcher from the CURRENT config, keeping
-  // the runner (its api/outbox/chains/SSE) intact. Used after a runtime-enabling
-  // config change so constructor-captured options — per-agent cwd/prepareHook and
-  // the adapter registry — pick up their new values without an app restart.
+  // the runner (its api, outbox, chains) intact, so constructor-captured options
+  // pick up a config change without a restart.
   rebuildDispatchers() {
     for (const wr of this.workspaces.values()) {
       for (const runner of wr.agents.values()) {
@@ -14913,8 +14545,7 @@ async function createCompanionRuntime(opts = {}) {
     }));
     await warnAboutHarnessReadiness(cfg, {
       probeClaude: async () => claudeCode,
-      // CT1085: the CLI's onboarding script owns the terminal and says this in
-      // its own words (the `!` block, or the per-harness offer), so it hands us a
+      // The CLI's onboarding script says this in its own words, so it hands a
       // sink that logs instead. Every other caller keeps the stderr line.
       ...opts.onReadinessWarning ? { warn: opts.onReadinessWarning } : {}
     });
@@ -14951,11 +14582,10 @@ async function createCompanionRuntime(opts = {}) {
   const clearRuntimeOnExit = () => clearRuntimeStateIfOurs(instanceId);
   process.on("exit", clearRuntimeOnExit);
   const hub = new CompanionStateHub({
-    // CT29: one device, one base URL — the cabane instance this device is paired
-    // with. The dashboard's connection line shows it.
+    // The dashboard's connection line shows it.
     baseUrl: cfg.baseUrl,
     companionVersion: COMPANION_VERSION,
-    // SJ516 F4: surfaced on `/api/status` so `stop`/`status` can confirm the
+    // Surfaced on `/api/status` so `stop`/`status` can confirm the
     // process behind the marker pid is this companion (not a recycled pid).
     instanceId
   });
@@ -15008,7 +14638,7 @@ async function createCompanionRuntime(opts = {}) {
       socket: control.path,
       ...dashboard ? { url: dashboard.url, port: dashboard.port } : {},
       startedAt,
-      // SJ495: the daemon launcher sets this env on the detached child, so the
+      // The daemon launcher sets this env on the detached child, so the
       // marker records whether this companion is backgrounded (foreground start
       // leaves it unset → false).
       daemon: process.env.CABANE_COMPANION_DAEMON === "1",