aegis-desktop 0.8.5 → 0.8.7

package/README.md

@@ -1,6 +1,6 @@
 # AEGIS Desktop
 
-![AEGIS Desktop running: the three-class model picker, an agent turn, a gated tool-approval diff, and the unattended work queue](https://raw.githubusercontent.com/aegisinfo/aegiscode-plugin/main/desktop/docs/demo.gif)
+![AEGIS Desktop running: the three-class model picker, an agent turn, a gated tool-approval diff, and the unattended work queue](docs/demo.gif)
 
 A standalone Electron chat app over the [AEGIS](https://aegiscloud.org) API,
 with an **agentic tool loop**: the model can read, write, and edit files,
@@ -9,9 +9,8 @@ delegate whole sub-tasks to subagents. It does **not** require Claude Code.
 
 ## Install
 
-Download a build from the
-[releases page](https://github.com/aegisinfo/aegiscode-plugin/releases) — the
-repo the release workflow publishes binaries to — or install from npm:
+Prebuilt binaries (AppImage / MSI+NSIS / dmg) ship with each release, and the
+package is on npm:
 
 ```bash
 npm install -g aegis-desktop     # requires Node 18+
@@ -114,16 +113,16 @@ stub and refuse to publish an asset that fails their assertions.
 
 **The model-class picker** — all three routes, switchable mid-conversation:
 
-![The model-class picker listing Aegis Cloud, Bring your own key, and Local](https://raw.githubusercontent.com/aegisinfo/aegiscode-plugin/main/docs/marketing-assets/01-model-class-picker.png)
+![The model-class picker listing Aegis Cloud, Bring your own key, and Local](docs/marketing-assets/01-model-class-picker.png)
 
 **A completed answer** in the transcript:
 
-![A completed answer in the transcript](https://raw.githubusercontent.com/aegisinfo/aegiscode-plugin/main/docs/marketing-assets/02-answer-complete.png)
+![A completed answer in the transcript](docs/marketing-assets/02-answer-complete.png)
 
 **The tool-call approval card** with a proposed edit — what blocks `exec`,
 `writeFile` and `editFile` until you allow, allow for the session, or deny:
 
-![The tool-call approval card with a proposed edit](https://raw.githubusercontent.com/aegisinfo/aegiscode-plugin/main/docs/marketing-assets/03-tool-approval-diff.png)
+![The tool-call approval card with a proposed edit](docs/marketing-assets/03-tool-approval-diff.png)
 
 ## Tools available to the model
 
@@ -156,7 +155,7 @@ aegiscode autonomous add "fix the flaky retry test" --cwd ~/repo --commit
 aegiscode autonomous list
 aegiscode autonomous run                 # drain one task, then stop
 aegiscode autonomous proceed --max 3     # drain up to three
-aegiscode autonomous reconcile --auto    # queue the next unfinished PLAN.md phase, then drain it
+aegiscode autonomous reconcile --auto    # queue the next unfinished phase of your plan file, then drain it
 aegiscode autonomous retry <id>          # put a finished task back
 aegiscode autonomous clear --all         # empty the queue
 ```
@@ -278,17 +277,12 @@ The app registers an `aegis://` protocol handler:
 
 ## Run from source
 
-```bash
-git clone https://github.com/aegiscloud/aegiscode-desktop.git
-cd aegiscode-desktop
-npm install
-npm start
-```
-
-Or, from the monorepo checkout, run this directory directly:
+A source checkout is available to contributors with repository access only — the
+desktop host is not a public repository. From the checkout, run this directory
+directly:
 
 ```bash
-cd aegiscode-plugin/desktop
+cd desktop
 npm install
 npm start
 ```
@@ -328,11 +322,7 @@ transport over the same AEGIS backend — see the repo root for that fuller
 architecture picture, and [cli/README.md](../cli/README.md) for the terminal
 host over the same engine.
 
-**Two repos, one product.** This directory is the source of truth. The
-standalone repo at
-[aegiscloud/aegiscode-desktop](https://github.com/aegiscloud/aegiscode-desktop)
-is a `git subtree split` of it — same code, published separately so it can be
-cloned and built on its own. Edits land here and are synced out; nothing is
-authored there. The npm package
-[`aegis-desktop`](https://www.npmjs.com/package/aegis-desktop) is built from
-that standalone repo.
+**One source of truth.** This directory is it. The npm package
+[`aegis-desktop`](https://www.npmjs.com/package/aegis-desktop) is built from a
+`git subtree split` of it — same code, published without the rest of the
+monorepo. Edits land here and are synced out; nothing is authored elsewhere.

package/docs/marketing-assets/README.md

@@ -0,0 +1,89 @@
+# Marketing assets — captions, claim, and tagged links
+
+The three PNGs in this directory are the **existing** asset kit (1440×900, shot
+against the real app — see `docs/marketing-log.md`, 2026-09-22 entry). Images
+carry no link of their own, so the outbound link for each placement lives here,
+in the same directory as the image it belongs to. Nothing in this directory is a
+new asset: these are the captions for the three files below, rewritten for the
+Phase 5 promotion pass (`docs/upgrade-conversion-plan.md` §5).
+
+**The one claim (Phase 3, verbatim, same sentence as the welcome panel):**
+
+> **The autonomous queue keeps running after you close the laptop.**
+
+Plus the honesty line that sits next to it:
+
+> Everything on your machine is free, permanently. The cloud drain is what you
+> pay for.
+
+(`desktop/renderer/app.js` → `PAID_PROMISE` / `FREE_HONESTY`, rendered by
+`#welcome-template` in `desktop/renderer/index.html`.)
+
+**What the caption must not be:** a tour of the three model classes, or the free
+local row written up as if it were the product. The screenshots show the picker
+and the diff card — that is *what the image is of*, not the *offer*. One claim
+per asset; the class list stays out of the caption.
+
+**Channel rule.** Facebook and Reddit are image-friendly; X and YouTube captions
+follow `docs/launch-copy-x-youtube.md` §2/§3. Every link is
+`https://aegiscloud.org/go/upgrade?s=<channel>&c=<campaign>` with `s` in
+`(x, youtube, reddit, facebook)` — the only channels `SIGNUP_SOURCES` in
+`aegis1/app.py` accepts — and one campaign id per channel, stable across every
+asset on that channel.
+
+| Image | Placement | Channel `s` | Campaign `c` | Tagged link (paste this exact URL) |
+|---|---|---|---|---|
+| `01-model-class-picker.png` | X post (picker + claim in the reply) | `x` | `x_launch` | `https://aegiscloud.org/go/upgrade?s=x&c=x_launch` |
+| `01-model-class-picker.png` | Reddit image post (r/LocalLLaMA, r/ollama — link in the closing block, after the limitations) | `reddit` | `reddit_launch` | `https://aegiscloud.org/go/upgrade?s=reddit&c=reddit_launch` |
+| `01-model-class-picker.png` | Facebook Page + groups (image + claim + link) | `facebook` | `facebook_launch` | `https://aegiscloud.org/go/upgrade?s=facebook&c=facebook_launch` |
+| `02-answer-complete.png` | YouTube Short / long-form B-roll; `Upgrade:` line in the description | `youtube` | `yt_launch` | `https://aegiscloud.org/go/upgrade?s=youtube&c=yt_launch` |
+| `02-answer-complete.png` | X post (answer in flight) | `x` | `x_launch` | `https://aegiscloud.org/go/upgrade?s=x&c=x_launch` |
+| `03-tool-approval-diff.png` | X pinned post / thread 3- (the diff card) | `x` | `x_launch` | `https://aegiscloud.org/go/upgrade?s=x&c=x_launch` |
+| `03-tool-approval-diff.png` | Reddit GIF+text post (r/ChatGPTCoding) | `reddit` | `reddit_launch` | `https://aegiscloud.org/go/upgrade?s=reddit&c=reddit_launch` |
+| `03-tool-approval-diff.png` | YouTube thumbnail / description | `youtube` | `yt_launch` | `https://aegiscloud.org/go/upgrade?s=youtube&c=yt_launch` |
+
+Every row above is registered in `docs/marketing-log.md` §7 so post-hoc revenue
+can be joined to the channel and the asset face that produced it.
+
+## Captions
+
+### `01-model-class-picker.png` — the class picker
+
+> The autonomous queue keeps running after you close the laptop. Everything on
+> your machine is free, permanently — the cloud drain is what you pay for.
+> npm i -g aegis-desktop
+> https://aegiscloud.org/go/upgrade?s=x&c=x_launch
+
+Facebook variant (same claim, same tagged shape, different channel):
+
+> The autonomous queue keeps running after you close the laptop. Cloud-backed
+> drain, survives a reboot, fans a task out across workers, memory carried
+> between tasks. Everything on your machine is free, permanently.
+> npm i -g aegis-desktop
+> https://aegiscloud.org/go/upgrade?s=facebook&c=facebook_launch
+
+Do **not** caption this image with the picker's three rows as the pitch. The
+picker is a fact about the product; the claim above is the offer.
+
+### `02-answer-complete.png` — an answer, complete
+
+> The autonomous queue keeps running after you close the laptop — the work does
+> not stop when the laptop does. Everything on your machine is free, permanently.
+> Install: `npm i -g aegis-desktop && aegis`
+> https://aegiscloud.org/go/upgrade?s=youtube&c=yt_launch
+
+### `03-tool-approval-diff.png` — the diff/approval card
+
+> The diff card is the whole product locally — and it is free, permanently. The
+> pocket-book item is the drain that keeps running after you close the laptop.
+> Install: `npm i -g aegis-desktop && aegis`
+> https://aegiscloud.org/go/upgrade?s=x&c=x_launch
+
+## Before posting (§0 of `docs/marketing-plan-social.md`)
+
+1. Re-verify the version (`desktop/package.json`) and re-shoot the image if the
+   UI moved; log that check in `docs/marketing-log.md` §6.
+2. Confirm the link still resolves and still carries `s=`/`c=`. A bare
+   `aegiscloud.org/subscribe` (bare, untagged) link files as `direct` and the channel
+   gets no row.
+3. Never invent a number in a caption (marketing-log §2 rule 1).

package/lib/avatar/companion.js

@@ -1,7 +1,7 @@
 'use strict';
 
 /**
- * companion.js — the four companion behaviours (PLAN Phase 23, spec §4).
+ * companion.js — the four companion behaviours.
  *
  * The behaviours are the morning brief, the idea log, the session reflection
  * and in-session recall. What they have in common is not their content, it is
@@ -42,7 +42,7 @@
  * checkable: nothing here may be a shell, a network call or anything that sends
  * data off the device, and `carveOuts()` is the assertion that says so.
  *
- * Pure: no `fs`, no Electron, no globals. See `docs/avatar-plan.md` §2 and §4.
+ * Pure: no `fs`, no Electron, no globals.
  */
 
 const level = require('./level.js');

package/lib/avatar/cosmetics.js

@@ -1,7 +1,7 @@
 'use strict';
 
 /**
- * cosmetics.js — the cosmetics pack format and its validator (Phase 24).
+ * cosmetics.js — the cosmetics pack format and its validator.
  *
  * WHY A FORMAT AT ALL. Spec §3 says the avatar is *data, not art*: a persona is
  * one JSON record and a look is a layered SVG assembled from a part manifest, so
@@ -196,7 +196,7 @@ function validatePack(raw) {
   for (const where of forbidden) {
     errors.push(
       `cosmetics packs may not carry \`${where}\` — a pack sells LOOKS only, never XP, ` +
-        'levels, recall breadth, approval friction or personalization (docs/avatar-plan.md §3)',
+        'levels, recall breadth, approval friction or personalization',
     );
   }
 

package/lib/avatar/events.js

@@ -17,7 +17,7 @@
  *    that throws on an unrecognised signal turns every future feature into a
  *    crash in the avatar, so the default transition is "stay put".
  *
- * The states are the ones `docs/avatar-plan.md` §4 lists, wired to signals that
+ * The states are wired to signals that
  * already exist: turn start/stream/end, `tool.*` from the tool host, the
  * approval card, queue progress, and sync status. No new event bus.
  *
@@ -175,7 +175,7 @@ const TABLE = Object.freeze({
 
 /**
  * Expression id per state. The renderer maps these to the persona's expression
- * pack; keeping the mapping here means Phase 22 needs no state knowledge.
+ * pack; keeping the mapping here means the renderer needs no state knowledge.
  */
 const EXPRESSIONS = Object.freeze({
   idle: 'neutral',

package/lib/avatar/holder-turn.js

@@ -1,13 +1,12 @@
 'use strict';
 
 /**
- * holder-turn.js — the seam where a holder reaches turn assembly (PLAN Phase 28;
- * docs/avatar-identity-plan.md §3, §4, §7).
+ * holder-turn.js — the seam where a holder reaches turn assembly.
  *
  * `register.js` turns a persona into a bounded tone fragment, `profile.js` folds
  * a holder's memory into evidence-gated facets, and `holders.js` owns the
  * directory and the isolation filter. This file is the only place they meet, and
- * it is where the one claim Phase 28 is really about gets decided:
+ * it is where the one claim this file is really about gets decided:
  *
  *   **Holder A's assembled prompt cannot contain holder B's text.**
  *
@@ -22,10 +21,10 @@
  *  - *The recall block.* The same filter runs on the recall rows, so an entry
  *    that arrives after the wrong cache still cannot be quoted into A's turn.
  *
- * The Phase 28 test drives both through `assemble()` — the function main.js
+ * The test drives both through `assemble()` — the function main.js
  * actually calls — and then through `engine.js` with this file's prompt builder
  * injected, grepping the system prompt a scripted transport received. That is
- * the Phase 18 lesson (never assert on a harness leg that was re-pointed) turned
+ * the lesson (never assert on a harness leg that was re-pointed) turned
  * on privacy: the interesting failure is a filter applied after the wrong cache,
  * and only the real path can show it.
  *
@@ -157,7 +156,7 @@ function profileFragment(fold, opts = {}) {
  * rows. Exported because main.js renders it into the memory pane as well, and
  * one implementation is one thing to get right.
  *
- * `opts.header` exists for the one caller that has no holder: Phase 20's turn
+ * `opts.header` exists for the one caller that has no holder: the account-level turn
  * assembly recalls the account's memory before any holder exists, and captioning
  * that block "this holder's memory" would be a lie told in the prompt. The
  * default stays the holder header, so every holder-scoped caller is unchanged.
@@ -253,7 +252,7 @@ function assemble(input = {}) {
     entryIds: scoped.map((row) => String(row && row.id)).filter(Boolean),
     recallIds: recall.entryIds,
     // Rows the recall block could not fit. Facet drops have their own field, so
-    // neither the usage accounting nor the Phase 28 assertions have to guess
+    // neither the usage accounting nor the assertions have to guess
     // which kind of "dropped" this is.
     dropped: recall.dropped,
     neutralizations: profile.neutralizations + recall.neutralizations + registerFragment.neutralizations,

package/lib/avatar/holders.js

@@ -1,11 +1,10 @@
 'use strict';
 
 /**
- * holders.js — who holds the memory (PLAN Phase 28; docs/avatar-identity-plan.md
- * §3, §4, §5).
+ * holders.js — who holds the memory.
  *
- * `identity.js` (Phase 25) decides *which* holder a set of signals points at and
- * refuses to merge two people on a fingerprint match. `profile.js` (Phase 25)
+ * `identity.js` decides *which* holder a set of signals points at and
+ * refuses to merge two people on a fingerprint match. `profile.js`
  * folds one holder's entries into bounded, evidence-gated facets. Neither of
  * them owns a directory. This file is that owner — the layout, the registry, the
  * switch, the conflict decision and the "why does it know this" surface — and it
@@ -32,7 +31,7 @@
  *     is the client-side filter §3 calls "the assertion that the fix happened":
  *     the server-side scope is the fix, and this is what proves it ran. It is
  *     used by the fold *and* by the recall block, so a leak needs to defeat one
- *     function rather than two call sites — and the Phase 28 test drives two
+ *     function rather than two call sites — and the test drives two
  *     holders through the real turn assembly and greps the prompt.
  *
  *  4. **Every claim is traceable and deletable.** `provenance()` renders a
@@ -63,7 +62,7 @@ const PROFILE_FILE = 'profile.json';
 const FORGOTTEN_FILE = 'forgotten.json';
 
 /**
- * The one thing a switch may leave behind. A list, not a sentence: the Phase 28
+ * The one thing a switch may leave behind. A list, not a sentence: the
  * test iterates it, so adding a survivor to the code without adding it here
  * makes the test fail rather than the promise quietly rot.
  */
@@ -445,7 +444,7 @@ function applyConflict(registry, resolution, choice = {}) {
  * particular and therefore to the holder asking, which is what makes a legacy
  * unstamped ledger readable instead of invisible.
  *
- * `clientFilter:false` exists only so the Phase 28 isolation test can prove the
+ * `clientFilter:false` exists only so the isolation test can prove the
  * filter is load-bearing by removing it and watching the leg go red. It is not
  * reachable from any IPC handler (holder-ipc.js never passes it).
  */

package/lib/avatar/identity.js

@@ -3,7 +3,7 @@
 /**
  * identity.js — whose memory it is.
  *
- * `docs/avatar-plan.md` made memory the value; value is meaningless
+ * Memory is the value; value is meaningless
  * unattributed. This module answers exactly one question — *which holder is at
  * the keyboard* — from signals the caller already has, and it answers with a
  * **proposal plus provenance**, never with a merge.
@@ -38,7 +38,7 @@
  *  4. **Resolution is pure and never writes.** `holders.json` is validated,
  *     repaired and copied; the input registry is never mutated, and the fields
  *     `proposal`/`conflict`/`needsMint` exist precisely so main writes the file
- *     with the user's confirmation (Phase 26) instead of this module guessing.
+ *     with the user's confirmation instead of this module guessing.
  *
  * Pure: no fs, no Electron, no crypto import — the caller supplies `hash` so
  * this file is testable in plain Node exactly like `lib/sync/*`.
@@ -149,10 +149,10 @@ function looksLikeRawKey(value) {
  *
  * Deterministic on purpose — the same machine seed produces the same id on a
  * reinstall, which is what keeps "the ledger survives a reinstall"
- * (`avatar-plan.md` §1.5) true for an install that never had a cloud key.
+ * true for an install that never had a cloud key.
  *
  * @returns {string|null} `null` when there is nothing trustworthy to mint from;
- *   the caller then falls back to random bytes (main, Phase 26).
+ *   the caller then falls back to random bytes.
  */
 function mintHolderId(hash, seed) {
   if (typeof hash !== 'function') return null;
@@ -424,7 +424,7 @@ function setActive(current, id) {
   return validate(base);
 }
 
-/** Phase 29 «forget»: drop one row, and re-point `active` if it was that row. */
+/** «forget»: drop one row, and re-point `active` if it was that row. */
 function removeHolder(current, id) {
   const base = validate(current).registry;
   const wanted = holderIdShape(id);
@@ -475,7 +475,7 @@ const CONFIDENCE = Object.freeze({
  *   `conflict.a` is what you would be switching away from (the registry's
  *   active holder, or the losing signal's holder) and `conflict.b` is the
  *   proposal. Returned so main can show a "who is at the keyboard?" card
- *   (Phase 28) instead of switching silently.
+ *   instead of switching silently.
  */
 function resolve(signals, registry) {
   const raw = signals && typeof signals === 'object' ? signals : {};
@@ -519,7 +519,7 @@ function resolve(signals, registry) {
     // A fingerprint that matches no registry row proves nothing about who this
     // is, so it can never *select* a holder. It can only be proposed for
     // binding onto the holder that WAS resolved, which main writes only after
-    // the user confirms (Phase 26) — this module never writes anything. Built
+    // the user confirms — this module never writes anything. Built
     // here rather than in the last rung so every rung reports it identically:
     // an explicit persona import with a freshly rotated key is the same
     // question as a fresh install with one.

package/lib/avatar/level.js

@@ -31,7 +31,7 @@
  *     they too cannot widen write/shell/network approval.
  *
  * Pure: no fs, no Electron, no process access except the `env` the caller
- * passes. See `docs/avatar-plan.md` §2.
+ * passes.
  */
 
 const { TIERS, tierFor, tierIndex } = require('./tiers.js');

package/lib/avatar/mirror.js

@@ -1,11 +1,10 @@
 'use strict';
 
 /**
- * mirror.js — the per-holder cloud mirror (PLAN Phase 29;
- * docs/avatar-identity-plan.md §6, extending docs/avatar-plan.md §1.5).
+ * mirror.js — the per-holder cloud mirror.
  *
- * Phase 20 put the ledger on disk, Phase 25 made a profile foldable from it and
- * Phase 28 gave every row a holder. All three are local. This file is the half
+ * Earlier work put the ledger on disk, made a profile foldable from it and
+ * gave every row a holder. All three are local. This file is the half
  * that leaves the machine, and it exists to make four claims true — each of
  * which is a test in `desktop/test/avatar-mirror.test.mjs`, not a paragraph:
  *
@@ -22,8 +21,8 @@
  *     `reconcile()` unions two sides by a content-addressed row id, deduplicates
  *     a row both machines already have, and sorts by `(t, id)`. Two machines
  *     that appended in opposite orders converge on the *same bytes*, and
- *     `derive()`'s order independence (docs/avatar-plan.md §1) makes that the
- *     same level. The Phase 29 ordering test feeds both interleavings and
+ *     `derive()`'s order independence makes that the
+ *     same level. The ordering test feeds both interleavings and
  *     asserts one level; the idempotence leg asserts feeding the union back in
  *     cannot double a level, which is what would actually hurt.
  *
@@ -337,7 +336,7 @@ function readMirror(memoryRows, holderId) {
  * trusted as a conclusion — `payload.profile`/`payload.facets` are dropped
  * explicitly and recorded in `refused`. The fold itself is `profile.fold()`
  * with `holder` supplied, so a facet can only cite an entry id that survived
- * the holder filter (Phase 25's pure-seam isolation) *and* exists in this
+ * the holder filter *and* exists in this
  * input (the `citable` set inside the fold).
  */
 function refold(input = {}) {

package/lib/avatar/packs/README.md

@@ -23,7 +23,7 @@ paid.
 ## The rule this directory exists to enforce
 
 **Cosmetics only.** Never XP, levels, recall breadth, approval friction or
-personalization (`docs/avatar-plan.md` §3, invariant 8). `validatePack` refuses a
+personalization. `validatePack` refuses a
 pack carrying `xp`, `level`, `recallEntries`, `approvals`, `toolGrants`,
 `modelFloor`, `proactivity`, `price`, `entitlement`, … at any depth, and refuses
 a `tier` that contradicts the unlock table — so a "paid pack that also widens a

package/lib/avatar/persona.js

@@ -7,7 +7,7 @@
  * that is a settings pane with hand-written branches for every option, which
  * makes a new outfit a code change and a commissioned art pack a fork. The way
  * this module does it: a persona is one JSON record, validated and coerced
- * here, and Phase 22's renderer assembles layered SVG from a part manifest. A
+ * here, and the renderer assembles layered SVG from a part manifest. A
  * theme is then a file. Zero code changes.
  *
  * Validation is REPAIR-ORIENTED, not reject-oriented, with exactly two hard
@@ -23,20 +23,20 @@
  * it is the user's own file.
  *
  * The one place that IS adversarial is the `register` block and the identity
- * strings, because they end up in the system prompt (Phase 21). Those are
+ * strings, because they end up in the system prompt. Those are
  * sanitized here at the storage boundary — control characters and newlines are
  * stripped so a name cannot break out of its line — and the *prompt* fragment
  * is additionally bounded and neutralized in `register.js`. Two layers, because
  * a name is user-authored text going into a prompt.
  *
- * Pure: no fs, no Electron. Phase 21's main process reads/writes the file.
+ * Pure: no fs, no Electron. The main process reads/writes the file.
  */
 
 /** Bump when the record shape changes; `migrate` walks old records forward. */
 const SCHEMA_VERSION = 1;
 
 /**
- * The part manifest. Ids only — geometry lives in `renderer/avatar/` (Phase 22),
+ * The part manifest. Ids only — geometry lives in `renderer/avatar/`,
  * which reads these same ids. Validation is against THIS list so a typo in a
  * hand-edited persona is caught at load rather than rendering an empty head.
  */
@@ -82,7 +82,7 @@ function has(list, value) {
 
 /**
  * Collapse whitespace and strip control characters. A name is a single line of
- * text in a UI, and (Phase 21) a single line in a prompt — so newlines, tabs and
+ * text in a UI, and a single line in a prompt — so newlines, tabs and
  * the unicode line separators are removed rather than escaped.
  */
 function cleanText(value, max) {

package/lib/avatar/profile.js

@@ -1,8 +1,7 @@
 'use strict';
 
 /**
- * profile.js — what *this holder's* memory is allowed to personalise (Phase 25,
- * identity plan §4).
+ * profile.js — what *this holder's* memory is allowed to personalise.
  *
  * `identity.js` answers "whose memory is it"; this module answers the question
  * that follows immediately: given that holder's own rows, what may the avatar
@@ -36,21 +35,21 @@
  *     Absence of evidence produces no facet: never "probably prefers terse
  *     answers".
  *  4. COLD START IS NEUTRAL. No evidence ⇒ `coldStart: true`, `facets: []`,
- *     `budget.used: 0`. Phase 27 renders that as an empty fragment, i.e. an
+ *     `budget.used: 0`. The renderer shows that as an empty fragment, i.e. an
  *     avatar that behaves exactly like an unconfigured install. It does not
- *     guess a personality, the same honesty rule as `avatar-plan.md` §1.4.
+ *     guess a personality.
  *  5. DETERMINISTIC. No clock (`now` is an argument), no randomness, no map
  *     iteration order leaking into output: facets are ordered by
  *     `(confidence desc, lastSeen desc, id asc)` and, for two facets of the
  *     same class on the same day, `key asc` — one extra term so the order is
  *     total and a permutation of the input cannot change the output bytes.
- *  6. BOUNDED. The assembled facets are capped at `BUDGET_TOKENS` (900, per
- *     §Phase 27), dropped whole, lowest priority first — never sliced
+ *  6. BOUNDED. The assembled facets are capped at `BUDGET_TOKENS` (900),
+ *     dropped whole, lowest priority first — never sliced
  *     mid-sentence, which is the failure mode a naive `slice()` produces.
  *
  * Pure: no fs, no Electron, no clock, no crypto. It reuses `persona.cleanText`
  * (the storage boundary's sanitizer) and `register.estimateTokens` (the same
- * 4-chars-per-token ceiling Phase 21 uses) so the two prompt fragments Phase 27
+ * 4-chars-per-token ceiling used elsewhere) so the two prompt fragments the renderer
  * concatenates are measured with one ruler.
  */
 
@@ -73,7 +72,7 @@ const FACET_IDS = Object.freeze([
   'toneCalibration',
 ]);
 
-/** §Phase 27: the profile fragment's ceiling. */
+/** The profile fragment's ceiling. */
 const BUDGET_TOKENS = 900;
 
 /** Longest a single facet `value` may be (it is UI text and prompt text). */
@@ -360,7 +359,7 @@ function orderFacets(facets) {
 /**
  * Take facets in priority order while they fit. Whole facets only: a fragment
  * that ends mid-sentence reads as a truncated thought, which is worse than a
- * shorter one, and §Phase 27 asserts exactly this.
+ * shorter one, and the test asserts exactly this.
  */
 function applyBudget(ordered, limit = BUDGET_TOKENS) {
   const kept = [];
@@ -384,12 +383,12 @@ function applyBudget(ordered, limit = BUDGET_TOKENS) {
 /**
  * Does this row belong to the holder being folded?
  *
- * Unstamped rows belong to whoever is asking: they predate Phase 26's stamping
+ * Unstamped rows belong to whoever is asking: they predate the stamping
  * and the alternative — dropping them — would silently empty the profile of
  * every existing install. A row stamped for *someone else* is never folded, and
  * that is the pure-seam half of §3's "isolation is the load-bearing property":
  * `sources` built downstream can only cite ids that survived this filter. The
- * real-seam half (Phase 28) asserts it again through actual turn assembly,
+ * real-seam half asserts it again through actual turn assembly,
  * because a filter applied after the wrong cache is exactly the bug a
  * pure-function test misses.
  */
@@ -844,9 +843,9 @@ if (Object.keys(FOLDERS).length !== FACET_IDS.length || FACET_IDS.some((id) => t
  * @param {object} input
  * @param {string} [input.holder]      the holder these rows belong to. Supplying
  *   it is how a caller states *whose* memory this is: rows stamped for another
- *   holder are dropped here and can therefore never be cited by a facet. Phase
- *   26 always passes it (the registry's `active`); omitting it means "the caller
- *   already scoped this input", which is why Phase 28 asserts the same property
+ *   holder are dropped here and can therefore never be cited by a facet. The
+ *   caller always passes it (the registry's `active`); omitting it means "the caller
+ *   already scoped this input", which is why the test asserts the same property
  *   again at the real turn-assembly seam.
  * @param {Array} [input.entries]      memory entries for this holder, aegis1's
  *   row shape: `{ id, content, role, tags: [], session, createdAt, … }`.

package/lib/avatar/register.js

@@ -2,7 +2,7 @@
 
 /**
  * register.js — the persona's register turned into ONE bounded system-prompt
- * fragment (Phase 21; shared by Phase 27's profile fragment).
+ * fragment.
  *
  * `persona.js` is the storage boundary: it sanitizes identity/register text on
  * the way to disk. This is the SECOND layer, and the one that matters at the
@@ -38,7 +38,7 @@
 
 const personaModule = require('./persona.js');
 
-/** ~300 tokens, per docs/avatar-plan.md §3. */
+/** ~300 tokens. */
 const MAX_FRAGMENT_TOKENS = 300;
 
 /**

package/lib/avatar/store.js

@@ -1,9 +1,9 @@
 'use strict';
 
 /**
- * store.js — the main process's half of level authority (Phase 20).
+ * store.js — the main process's half of level authority.
  *
- * Phase 19 shipped the avatar core as five pure modules with no IO at all:
+ * The avatar core shipped as five pure modules with no IO at all:
  * `xp.js` knows what an event is worth and how a ledger replays into a level,
  * `level.js` knows what a level buys, but neither can read a file or a clock.
  * This file is the missing half and it deliberately owns *only* the two things
@@ -51,11 +51,11 @@ const personaModule = require('./persona.js');
 const LEDGER_DIR = 'avatar';
 const LEDGER_FILE = 'ledger.jsonl';
 /**
- * `<userData>/avatar/persona.json` — the persona DOCUMENT (Phase 21).
+ * `<userData>/avatar/persona.json` — the persona DOCUMENT.
  *
  * It lives here, next to the ledger and not in settings.json, because a persona
  * is a document rather than a preference: it is imported, exported, hand-edited
- * and eventually synced per holder (Phase 26), and every one of those paths
+ * and eventually synced per holder, and every one of those paths
  * wants validation on the way in. The `__avatar` settings namespace holds only
  * the three switches (lib/settings.js), so a renderer can never write a persona
  * through the settings surface.
@@ -206,7 +206,7 @@ function createAvatarStore({ dir, now = () => Date.now(), env = process.env, log
    *
    * `award()` above is the internal path: its callers are hooks that already
    * know which kind they are recording. This is the externally reachable one
-   * (Phase 21's `aegis:avatarAward`), so it is the one that must not be a
+   * (`aegis:avatarAward`), so it is the one that must not be a
    * generic "write a line into the ledger" bridge: an unknown kind is refused
    * with a reason rather than written as a zero-XP line, which keeps the ledger
    * a record of priced events only. `xp` is never accepted from the caller —
@@ -226,7 +226,7 @@ function createAvatarStore({ dir, now = () => Date.now(), env = process.env, log
     return { ok: true, kind: name, xp: xp.xpFor(name), entry };
   }
 
-  // --- persona document (Phase 21) ----------------------------------------
+  // --- persona document ----------------------------------------
   // The persona is read and written ONLY here, by main. Both directions run
   // through persona.js validation, so a hand-edited or imported file is
   // repaired with warnings rather than trusted, and the identity/register text

package/lib/avatar/transfer.js

@@ -1,8 +1,7 @@
 'use strict';
 
 /**
- * transfer.js — persona export, persona import and per-holder forget
- * (PLAN Phase 29; docs/avatar-identity-plan.md §5 and §7.3).
+ * transfer.js — persona export, persona import and per-holder forget.
  *
  * A persona is taste. Memory is not. This file exists to keep those two apart
  * across the one boundary where they would otherwise merge — moving a persona