comisai 1.0.44 → 1.0.46

package/node_modules/@comis/daemon/dist/api/obs-handlers/fleet-findings.js

@@ -1,24 +1,22 @@
-import { chimericModelFromRow, DEDICATED_SCRIPT_SIGNALS, deliveryDeadletteredFromRow, flaggedPostureKeys, healthSignalLabel, multilingualFromRow, nodeBudgetExceededFromRow, pipelineAuthoringFromRow, pricingGapFromRow, sandboxDowngradeFromRow, scriptZeroHitFromRow, servedBelowConfiguredFromRow, voiceDegradedFromRow, } from "./fleet-findings-extractors.js";
+import { chimericModelFromRow, DEDICATED_SCRIPT_SIGNALS, deliveryDeadletteredFromRow, flaggedPostureKeys, healthSignalLabel, healthSignalReason, multilingualFromRow, nodeBudgetExceededFromRow, orchestrateEfficiencyFromRow, pipelineAuthoringFromRow, pricingGapFromRow, sandboxDowngradeFromRow, scriptZeroHitFromRow, servedBelowConfiguredFromRow, voiceDegradedFromRow, } from "./fleet-findings-extractors.js";
 import { buildAutonomyFindings } from "./fleet-autonomy.js";
 /**
- * TELEM-01 (Plan 173-03): the pipeline-authoring aggregate the Phase-174 gate
+ * The pipeline-authoring aggregate the authoring gate
  * (`pipelineAuthoringGate`) consumes — computed compute-on-read over the windowed
- * `health_signal` rows (no persisted rollup; Open Q2 / D-AGGREGATE).
+ * `health_signal` rows (no persisted rollup).
  *
- * The `PipelineAuthoringAggregate` type is now SINGLE-SOURCED in
- * `@comis/observability` (Plan 173-04, MEDIUM-4) — the provisional local
- * interface declared here at Plan 03 was deleted and this file imports the
- * canonical type (see the top-of-file `import type`). The field NAMES + ORDER
- * (`smallTierInvocations`, `smallTierValidRate`, `frontierValidRate`) are
- * unchanged — the swap is structural.
+ * The `PipelineAuthoringAggregate` type is SINGLE-SOURCED in
+ * `@comis/observability` — this file imports the
+ * canonical type (see the top-of-file `import type`) rather than declaring a
+ * local duplicate.
  *
- * The small/local tier = capabilityClass "small" OR "nano" (D-TIER); frontier =
+ * The small/local tier = capabilityClass "small" OR "nano"; frontier =
  * "frontier". "mid" and "unknown" rows are in NEITHER cohort (they are not the
  * comparison tiers). Rates are 0 (never NaN) when the cohort is empty.
  *
  * Reduce the windowed `health_signal` rows to the `PipelineAuthoringAggregate`.
  * PURE — no I/O, no globals, no Date.now(); malformed / non-pipeline rows fold out
- * (counted in neither cohort, never throws). Exported so Plan 04 / fleet-health.ts
+ * (counted in neither cohort, never throws). Exported so fleet-health.ts
  * can feed the gate.
  */
 export function pipelineAuthoringAggregateFromRows(rows) {
@@ -40,7 +38,7 @@ export function pipelineAuthoringAggregateFromRows(rows) {
             if (parsed.schemaValid)
                 frontierValid += 1;
         }
-        // "mid" / "unknown": counted in neither cohort (D-TIER).
+        // "mid" / "unknown": counted in neither cohort (not comparison tiers).
     }
     return {
         smallTierInvocations: smallTotal,
@@ -49,14 +47,15 @@ export function pipelineAuthoringAggregateFromRows(rows) {
     };
 }
 /**
- * Derive `{code, detail, count, hint}` findings from the I-track rows. Counts +
- * short codes + hints ONLY — NEVER the raw `row.message`/`row.details` body (H1 +
- * the 159 schema is digest-only). `health_signal` rows are grouped by their
+ * Derive `{code, detail, count, hint}` findings from the ingested diagnostic rows. Counts +
+ * short codes + hints ONLY — NEVER the raw `row.message`/`row.details` body (the
+ * report schema is digest-only). `health_signal` rows are grouped by their
  * closed `signal` label (so distinct signal classes are distinct findings);
- * `model_health` / `config_posture` are category-level rollups. The OBS-01
+ * `model_health` / `config_posture` are category-level rollups. The
  * script signals get DEDICATED findings (script=/lane= grouping + named knob
  * hints) and are excluded from the generic rollup so they are not double-reported
- * (mirrors how KNOB-03's dedicated finding sits beside the config_posture rollup).
+ * (mirrors how the served-below-configured dedicated finding sits beside the
+ * config_posture rollup).
  */
 /** Defensive `details` JSON parse: malformed / missing → `{}` (digest-only, never throws, never echoes a body). */
 function parseDetailsObject(details) {
@@ -67,37 +66,75 @@ function parseDetailsObject(details) {
         return {};
     }
 }
-/** The closed reflection admission-outcome vocabulary (OBS-3b) — off-vocabulary folds to "unknown". */
+/** The closed reflection admission-outcome vocabulary — off-vocabulary folds to "unknown". */
 const REFLECT_ADMISSION_OUTCOMES = new Set([
     "admitted", "uncorroborated", "rejected_validation", "rejected_name_length",
     "untrusted_origin", "empty_reflection", "no_successes",
 ]);
+/** The orchestrate failure classes that SIGKILL the child MID-run — the wall-clock
+ *  timeout and the stdout hard cap. runAggregate reports the bytes materialized
+ *  BEFORE the kill, but the run never sliced/consumed them, so their estSavedTokens
+ *  is phantom (nothing was actually kept out of any context). Excluded from the
+ *  summed fleet savings while the run still counts (degraded). A COMPLETED run —
+ *  clean, `nonzero_exit`, or `lease_absent` — really did keep its materialized bytes
+ *  out of context, so its savings are real and counted; `spawn_fail` materializes
+ *  nothing (empty results/) so it never inflates the sum either. */
+const ORCHESTRATE_HARD_KILL_CLASSES = new Set(["timeout", "stdout_cap"]);
 export function buildFindings(healthSignals, modelHealth, configPosture, 
-// OBS-3b (hindsight-reflection-20260626): the windowed `learning_health` rows (the reflection
-// funnel). Defaulted `[]` so the pre-OBS-3b callers/tests stay byte-identical.
+// The windowed `learning_health` rows (the reflection
+// funnel). Defaulted `[]` so callers that do not read this category stay unchanged.
 learningHealth = [], 
-// OBS-2b (reflect-obs-20260627): the windowed `memory_lifecycle` rows (the forget sweep). Defaulted
-// `[]` so the pre-OBS-2b callers/tests stay byte-identical.
-memoryLifecycle = []) {
+// The windowed `memory_lifecycle` rows (the forget sweep). Defaulted
+// `[]` so callers that do not read this category stay unchanged.
+memoryLifecycle = [], 
+// The windowed `cron_wake_gate` rows (each gated cron fire). Defaulted
+// `[]` so callers that do not read this category stay unchanged.
+cronWakeGate = []) {
     const findings = [];
     // health_signal — one finding per closed `signal` label (counts only). The
-    // OBS-01 script labels are EXCLUDED here (they get dedicated findings below).
+    // dedicated-signal labels are EXCLUDED here (they get dedicated findings below).
+    // Severity-info rows are EXCLUDED too: the ingest layer stamps benign
+    // reasons (session_rebase / serialized_wait — BENIGN_DAG_DEGRADED_REASONS)
+    // severity "info" precisely so they do not read as degradation; folding them
+    // here anyway surfaced a fresh session's once-per-start rebase as an
+    // actionable lcd_divergence finding with a dead-end hint. Only warning+
+    // rows are findings (the model_health rollup's established discipline).
     const bySignal = new Map();
+    // Per-signal reason breakdown — which failure class recurred (the row's
+    // details.reason), so a recurring finding names it without a per-session explain.
+    const reasonsBySignal = new Map();
     for (const row of healthSignals) {
+        if (row.severity === "info")
+            continue;
         const label = healthSignalLabel(row);
         if (DEDICATED_SCRIPT_SIGNALS.has(label))
             continue;
         bySignal.set(label, (bySignal.get(label) ?? 0) + 1);
+        const reason = healthSignalReason(row);
+        if (reason !== undefined) {
+            const byReason = reasonsBySignal.get(label) ?? new Map();
+            byReason.set(reason, (byReason.get(reason) ?? 0) + 1);
+            reasonsBySignal.set(label, byReason);
+        }
     }
     for (const [label, count] of bySignal) {
+        // Deterministic per-reason breakdown (count desc, then reason asc) appended
+        // to the detail when the signal's rows carried reasons.
+        const byReason = reasonsBySignal.get(label);
+        const breakdown = byReason
+            ? [...byReason.entries()]
+                .sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0]))
+                .map(([reason, n]) => `${reason}=${n}`)
+                .join(", ")
+            : "";
         findings.push({
             code: `health_signal:${label}`,
-            detail: `${count} ${label} health signal(s) in the window`,
+            detail: `${count} ${label} health signal(s) in the window${breakdown ? ` (${breakdown})` : ""}`,
             count,
             hint: "run `comis explain` on an affected session; inspect the recurring health WARNs",
         });
     }
-    // OBS-01 (Phase 180): dedicated script_zero_hit finding — one per
+    // Dedicated script_zero_hit finding — one per
     // (scriptClass, lane) group, reading "N non-Latin zero-hit searches
     // (script=X, lane=Y)". Counts + closed enums only; the hint names the repair
     // that backfills the normalized trigram twins (history backfill).
@@ -118,7 +155,7 @@ memoryLifecycle = []) {
             hint: "non-Latin search found nothing on a cleanly-executed lane; rebuild the normalized trigram twins with `comis doctor --repair` (history backfill), then `comis explain` an affected session",
         });
     }
-    // OBS-01 (Phase 180): dedicated summary_language_mismatch finding — a single
+    // Dedicated summary_language_mismatch finding — a single
     // rollup count whose hint names the exact knob (a non-Latin chunk summarized in
     // Latin; visibility only, never gated). Counts only, no source/summary body.
     const mismatchCount = healthSignals.filter((row) => healthSignalLabel(row) === "summary_language_mismatch").length;
@@ -130,9 +167,9 @@ memoryLifecycle = []) {
             hint: "summaries are drifting to Latin for non-Latin sources; set contextEngine.compaction.strongerSummarizerModel to a model that preserves the source language (visibility only — not gated)",
         });
     }
-    // GENQ-01: dedicated generation_quality finding — the memory-generation analog of
+    // Dedicated generation_quality finding — the memory-generation analog of
     // summary_language_mismatch over the consolidation/reasoning/user-representation
-    // passes (the F-ML1 regression class made a fleet count instead of an offline
+    // passes (a regression class surfaced as a fleet count instead of an offline
     // probe). Counts only, no source/generated body; visibility only, never gated.
     const genQualityCount = healthSignals.filter((row) => healthSignalLabel(row) === "generation_quality").length;
     if (genQualityCount > 0) {
@@ -143,17 +180,17 @@ memoryLifecycle = []) {
             hint: "a memory-generation pass (consolidation/reasoning/user-representation) is producing low-quality output for non-Latin sources; the memory-pipeline model is too weak — configure a stronger memory model or pin providers.entries.<id>.capabilities.capabilityClass to frontier/mid (the R6 memory-ops override). Visibility only — not gated",
         });
     }
-    // TELEM-01 (Plan 173-03): dedicated pipeline_authoring finding — the HEADLINE
+    // Dedicated pipeline_authoring finding — the HEADLINE
     // metric is the small-model pipeline-authoring failure rate = (small-tier rows
-    // where schemaValid===false) / (small-tier rows total) over the window (D-TIER:
-    // small|nano = the small tier). Counts + a static hint ONLY (no source/generated
+    // where schemaValid===false) / (small-tier rows total) over the window
+    // (small|nano = the small tier). Counts + a static hint ONLY (no source/generated
     // graph body — the pipelineAuthoringFromRow parser reads only the closed tier +
     // the schemaValid boolean). Fires only when smallTotal > 0 (no finding on zero
-    // small-tier traffic — mirrors the GENQ-01/voice if-guards). The reducer above is
-    // the same compute-on-read fold; here we re-walk for the invalid COUNT the finding
-    // names.
+    // small-tier traffic — mirrors the generation-quality/voice if-guards). The reducer
+    // above is the same compute-on-read fold; here we re-walk for the invalid COUNT the
+    // finding names.
     //
-    // METRIC BOUNDARY (Phase 173 review WR-02): the denominator counts every
+    // METRIC BOUNDARY: the denominator counts every
     // CONTRACT-PARSE-REACHABLE authoring invocation. graph.define emits
     // schemaValid:false on BOTH a strict-contract (GraphDefineContract) parse
     // rejection AND a buildGraphInput parse/validate throw; graph.execute (a loose
@@ -181,10 +218,50 @@ memoryLifecycle = []) {
             code: "pipeline_authoring",
             detail: `${smallInvalid}/${smallTotal} small-tier pipeline authorings invalid (rate ${pct}%)`,
             count: smallInvalid,
-            hint: "small/local models are failing to author valid pipeline DAGs; this is the Phase-174 (small-model-authorable DAGs) gate metric — review before enabling orchestration.authoring.*",
+            hint: "small/local models are failing to author valid pipeline DAGs; this is the small-model-authorable-DAGs gate metric — review before enabling orchestration.authoring.*",
         });
     }
-    // ORCH-OBS (orchestration-observability): dedicated sandbox_downgrade_refused
+    // Dedicated orchestrate_efficiency finding — the daemon-wide MEASURED
+    // token savings from completed orchestrate runs, rolled up over the window: the
+    // run count + the summed est. tokens saved (+ a degraded-run count when any run
+    // carried a closed failureClass). The saving is the counterfactual of
+    // materializing large tool results as ResultRefs instead of re-entering them into
+    // context. Counts + token ESTIMATES + the closed failureClass ONLY — never the
+    // runId, the stdout, the resultRefBytes, or the stderr tail (safe to paste). Zero-
+    // traffic guard (the voice_health if-pattern). estSavedTokens coerces to 0 for a
+    // run that materialized nothing, so it still counts as a run without inflating the
+    // sum; a HARD-KILLED run (timeout / stdout_cap) is counted (degraded) but its
+    // PHANTOM savings are EXCLUDED from the summed estimate (see
+    // ORCHESTRATE_HARD_KILL_CLASSES) — the child was SIGKILLed before it consumed the
+    // bytes runAggregate measured, so those tokens were never actually kept out of
+    // context.
+    let orchestrateRunCount = 0;
+    let orchestrateEstSavedTotal = 0;
+    let orchestrateDegradedRuns = 0;
+    for (const row of healthSignals) {
+        const parsed = orchestrateEfficiencyFromRow(row);
+        if (parsed === null)
+            continue;
+        orchestrateRunCount += 1;
+        if (parsed.failureClass !== undefined)
+            orchestrateDegradedRuns += 1;
+        // Sum only savings that were REALLY kept out of context: a completed run
+        // (clean / nonzero_exit / lease_absent) or the coerced-0 no-materialization run.
+        // A hard-killed run's materialized bytes were never consumed — exclude them.
+        if (parsed.failureClass === undefined || !ORCHESTRATE_HARD_KILL_CLASSES.has(parsed.failureClass)) {
+            orchestrateEstSavedTotal += parsed.estSavedTokens;
+        }
+    }
+    if (orchestrateRunCount > 0) {
+        const base = `${orchestrateRunCount} orchestrate run(s), ~${orchestrateEstSavedTotal} est. tokens saved`;
+        findings.push({
+            code: "orchestrate_efficiency",
+            detail: orchestrateDegradedRuns > 0 ? `${base} (${orchestrateDegradedRuns} degraded)` : base,
+            count: orchestrateRunCount,
+            hint: "measured token savings from orchestrate runs materializing large tool results as ResultRefs instead of re-entering them into context; run `comis explain` on a session for the per-run savings breakdown",
+        });
+    }
+    // Dedicated sandbox_downgrade_refused
     // finding — the count of fail-closed sub-agent spawn refusals + the violated
     // sandbox dimensions (closed enum labels). A spawn refusal is fail-closed working,
     // but it means an agent was configured to spawn a LESS-confined child (a
@@ -215,7 +292,7 @@ memoryLifecycle = []) {
             hint: "a sub-agent was configured LESS confined than its spawner on the named dimension(s); align the child's skills.execSandbox posture with (or stricter than) the parent's, or remove the offending agent-to-agent spawn. run `comis explain` on the spawner's session",
         });
     }
-    // ORCH-OBS: dedicated delivery_deadlettered finding — the count of sub-agent
+    // Dedicated delivery_deadlettered finding — the count of sub-agent
     // completions PERMANENTLY DROPPED (self-healing delivery exhausted retries, or an
     // immediate permanent failure). This is a SILENT degradation today (the graph
     // reports completed while a node's result never reached the parent). Counts + the
@@ -240,7 +317,7 @@ memoryLifecycle = []) {
             hint: "a sub-agent result was permanently dropped before reaching its parent (the graph still reports completed); run `comis explain` on the affected session and check the delivery channel health / retry budget (security.agentToAgent.delivery)",
         });
     }
-    // ORCH-OBS: dedicated node_budget_exceeded finding — the count of per-node token
+    // Dedicated node_budget_exceeded finding — the count of per-node token
     // budget breaches + the DOMINANT cap source (which knob bound the node). Counts +
     // the closed capSource label + a hint NAMING all three knobs ONLY (the per-node
     // token numbers are per-incident — on the node error string + the WARN + `comis
@@ -265,17 +342,17 @@ memoryLifecycle = []) {
             hint: "graph nodes are being cut off by their token budget; raise the binding knob — the node's own `tokenBudget`, the operator default `security.agentToAgent.tokenBudget`, or the graph `budget.maxTokens` (inherit-share). run `comis explain` for the per-node numbers",
         });
     }
-    // FLEET-01 (Phase 220-03): the three dedicated autonomy findings (durable_orphaned
+    // The three dedicated autonomy findings (durable_orphaned
     // / autonomy_revoked / autonomy_killed; kill separable from revoke) — extracted to
     // the `fleet-autonomy.ts` sibling (the obs-handlers 500-line subdir cap). Each has
     // its own zero-traffic guard inside the helper; the returned findings inherit the
     // FLEET_FINDINGS_CAP bound + the highest-count-first sort below.
     findings.push(...buildAutonomyFindings(healthSignals));
-    // OBS-04 (Phase 196): dedicated voice_health finding — the degraded STT/TTS
+    // Dedicated voice_health finding — the degraded STT/TTS
     // turn count + the DOMINANT voice errorKind (the closed domain SttErrorKind),
     // rolled up from the `voice_degraded` health_signal rows the daemon voice obs
     // emits on a transcription/synthesis failure. Counts + a closed errorKind label
-    // + a STATIC hint ONLY — NEVER a raw provider message body or a secret (the H1
+    // + a STATIC hint ONLY — NEVER a raw provider message body or a secret (the
     // no-body rule; safe to paste). Mirrors the `model_health` if-guard + the
     // script-signal dedicated-grouping pattern. Beside model_health/config_posture.
     let voiceDegradedCount = 0;
@@ -320,11 +397,12 @@ memoryLifecycle = []) {
         });
     }
     if (modelHealth.length > 0) {
-        // EMB-01: multilingual advisory read from the LATEST model_health row
-        // (STANDING STATE, not a reboot count — mirror the KNOB-03 latest-row pattern
-        // below, NOT the generic count above; Pitfall 4). Counts/codes/hints only; the
-        // hint names the DOC-01 recommendation + the I4 FTS floor. Advisory ONLY — no
-        // recall/search behavior gates on these flags anywhere (I4).
+        // Multilingual advisory read from the LATEST model_health row
+        // (STANDING STATE, not a reboot count — mirror the served-below latest-row
+        // pattern below, NOT the generic count above). Counts/codes/hints only; the
+        // hint names the recommended multilingual models + the FTS trigram floor that
+        // still carries recall. Advisory ONLY — no recall/search behavior gates on
+        // these flags anywhere.
         let latestModelHealth = modelHealth[0];
         for (const row of modelHealth) {
             if (row.timestamp > latestModelHealth.timestamp)
@@ -358,7 +436,7 @@ memoryLifecycle = []) {
             if (row.timestamp > latest.timestamp)
                 latest = row;
         }
-        // T1.3 (F6): name the SPECIFIC flagged keys (closed labels only) so an operator does
+        // Name the SPECIFIC flagged keys (closed labels only) so an operator does
         // not have to grep daemon.log to learn WHICH knob is off (gateway.tls, CANARY_SECRET…).
         const flaggedKeys = flaggedPostureKeys(latest);
         findings.push({
@@ -369,7 +447,7 @@ memoryLifecycle = []) {
             count: configPosture.length,
             hint: "reconcile the named flagged keys against the secure baseline (served-below + chimeric model have their own findings)",
         });
-        // KNOB-03: dedicated served-below-configured finding from the latest posture row.
+        // Dedicated served-below-configured finding from the latest posture row.
         const latestCount = servedBelowConfiguredFromRow(latest);
         if (latestCount > 0) {
             findings.push({
@@ -379,9 +457,9 @@ memoryLifecycle = []) {
                 hint: "set OLLAMA_CONTEXT_LENGTH / Modelfile 'PARAMETER num_ctx' to the configured window (config-yaml served-window section); run `comis explain` on a served-bound session for the numbers",
             });
         }
-        // RESOLVE-01: dedicated chimeric-provider/model finding from the SAME latest
+        // Dedicated chimeric-provider/model finding from the SAME latest
         // posture row. A NATIVE provider (anthropic/openai/google) paired with a foreign
-        // model family resolves a phantom ModelProfile (incident ffe11736) — name it.
+        // model family resolves a phantom ModelProfile (observed live) — name it.
         const chimeraCount = chimericModelFromRow(latest);
         if (chimeraCount > 0) {
             findings.push({
@@ -391,9 +469,9 @@ memoryLifecycle = []) {
                 hint: "align agents.<id>.provider with the model family (e.g. provider:anthropic ⇒ a claude model; for a qwen/llama model use an ollama/openrouter provider), or set the model id explicitly under the right provider",
             });
         }
-        // SPEND-05: dedicated pricing-gap finding from the SAME latest posture row.
+        // Dedicated pricing-gap finding from the SAME latest posture row.
         // Configured agents burning tokens on remote-unknown-priced models (a NATIVE
-        // provider with no catalog rate — the ffe11736 fail-open where spend is silently
+        // provider with no catalog rate — the fail-open where spend is silently
         // under-counted as $0). Surfaces the kill-switch's pricing coverage so an operator
         // sees how much spend the ceiling cannot account for. Counts + remediation only.
         const pricingGapCount = pricingGapFromRow(latest);
@@ -406,7 +484,7 @@ memoryLifecycle = []) {
             });
         }
     }
-    // OBS-3b (hindsight-reflection-20260626): dedicated learning_health finding — the reflection funnel
+    // Dedicated learning_health finding — the reflection funnel
     // rolled up over the window. The daemon-wide "is reflection learning / why-0-admitted" posture, beside
     // model_health / config_posture. Counts + the LATEST closed admissionOutcome verdict (standing state,
     // max-timestamp scan — never assume query order) + summed admitted/untrustedDrops ONLY (the
@@ -438,7 +516,7 @@ memoryLifecycle = []) {
             hint: 'run `cron.runs jobName "Reflection"` for the per-run funnel; admitted=0 with untrustedDrops/uncorroborated is the anti-poison gates WORKING (not a fault); admitted=0 DESPITE genuine corroboration ⇒ a topicKey under-merge — `comis explain` the reflection run',
         });
     }
-    // OBS-2b (reflect-obs-20260627): the dedicated memory_lifecycle finding — the forget sweep rolled up
+    // The dedicated memory_lifecycle finding — the forget sweep rolled up
     // over the window (the parity of learning_health for the forget half). Counts ONLY (summed evicted/
     // demoted across the window's sweeps; every details field parsed defensively). A sweep that evicted
     // nothing (no eviction-candidates) is NOT a fault — healthy maintenance — so the hint says so.
@@ -456,7 +534,45 @@ memoryLifecycle = []) {
             code: "memory_lifecycle",
             detail: `${memoryLifecycle.length} forget sweep(s) in the window; evicted=${evictedSum}, demoted=${demotedSum}`,
             count: memoryLifecycle.length,
-            hint: 'run `cron.runs jobName "Memory lifecycle"` for the per-sweep counts; evicted=0 is usually healthy (no corroborated-wrong / dormant candidates) — NOT a fault. Eviction is gated by learning.forget + the INV-4 exemptions (pinned/high-proof/system survive).',
+            hint: 'run `cron.runs jobName "Memory lifecycle"` for the per-sweep counts; evicted=0 is usually healthy (no corroborated-wrong / dormant candidates) — NOT a fault. Eviction is gated by learning.forget + the anti-induced-eviction exemptions (pinned/high-proof/system survive).',
+        });
+    }
+    // The dedicated cron_wake_gate_efficiency finding — the wake-gate rolled up over
+    // the window (the fleet-visible savings + suppression signal). Counts ONLY (fire count
+    // + summed skipped/turnsSaved/toolCalls; every details field parsed defensively — never
+    // the gate's script/payload). A skip is SAVINGS, not a fault (info severity — it must
+    // NOT inflate the fleet degrade count, the benign-reason discipline), so the hint says
+    // so; the two signals to inspect are a 100% skip-rate on a monitor you expect to fire,
+    // and toolCalls exceeding turnsSaved (a gate that costs more than it saves). The
+    // per-agent breakdown lives in the FleetHealthReport.cronWakeGate block.
+    if (cronWakeGate.length > 0) {
+        let skippedSum = 0;
+        let failedOpenSum = 0;
+        let turnsSavedSum = 0;
+        let toolCallsSum = 0;
+        for (const row of cronWakeGate) {
+            const d = parseDetailsObject(row.details);
+            if (d.wake === false)
+                skippedSum += 1;
+            if (d.failedOpen === true)
+                failedOpenSum += 1;
+            if (typeof d.estTurnsSaved === "number")
+                turnsSavedSum += d.estTurnsSaved;
+            if (typeof d.toolCalls === "number")
+                toolCallsSum += d.toolCalls;
+        }
+        // A fail-open wake (crash/timeout/over-cap/no-verdict) saves nothing and costs
+        // the gate's own cap-calls + jail spawn; a gate that fails open EVERY fire is
+        // broken but reads skipRate 0 (looks like a busy monitor). Surface the count so
+        // it is legible beside the 100%-skip poison signal.
+        const failOpenNote = failedOpenSum > 0
+            ? ` A fail-open wake saves nothing and costs the gate's own run; a gate failing open every fire is broken (not a busy monitor).`
+            : "";
+        findings.push({
+            code: "cron_wake_gate_efficiency",
+            detail: `${cronWakeGate.length} gated cron fire(s) in the window; skipped=${skippedSum}, failedOpen=${failedOpenSum}, turnsSaved=${turnsSavedSum}, toolCalls=${toolCallsSum}`,
+            count: cronWakeGate.length,
+            hint: `run \`cron.runs jobName "<job>"\` for the per-fire gate decisions; a high skip-rate is the gate WORKING (savings), not a fault; a 100% skip-rate on a monitor you expect to fire, a high failedOpen count, or toolCalls exceeding turnsSaved, is the signal to inspect.${failOpenNote}`,
         });
     }
     // Deterministic order: highest-count first, then code asc (stable tie-break).

package/node_modules/@comis/daemon/dist/api/obs-handlers/fleet-health.d.ts

@@ -1,35 +1,36 @@
 /**
- * `obs.fleet.health` RPC handler — the cross-session FleetHealthReport assembler
- * (Phase 161 R2 + H1). The SIBLING of `obs-explain.ts`: `obs.explain` post-mortems
+ * `obs.fleet.health` RPC handler — the cross-session FleetHealthReport assembler.
+ * The SIBLING of `obs-explain.ts`: `obs.explain` post-mortems
  * ONE session; this rolls up a WINDOW of sessions into a bounded, deterministic,
  * digest-only fleet triage.
  *
  * The assembler is a READ FAN-IN over four EXISTING, bounded, soft-fail sources
  * (the `assembleIncidentReportFromSources` shape — that reads 4 sources too):
  *
- *   A1 + A2 — `ObservabilityStore.aggregateSessionsInWindow(sinceMs)` ->
+ *   session rollup — `ObservabilityStore.aggregateSessionsInWindow(sinceMs)` ->
  *             `reduceFleetWindow` (pure cross-session reduce; synthetic excluded).
- *   A3      — `readSessionIndexWindow(dataDir, sinceMs, nowMs)` (multi-day
+ *   activity index — `readSessionIndexWindow(dataDir, sinceMs, nowMs)` (multi-day
  *             activity aggregate; `daysRead`/`daysMissing` feed the coverage
  *             honesty block). `nowMs` is the SAME injected instant as `sinceMs`,
- *             so the A3 day-key window tracks the injected clock (WR-01).
- *   I-track — `queryDiagnostics({ category })` over the Phase-160
+ *             so the session-index day-key window tracks the injected clock.
+ *   diagnostics — `queryDiagnostics({ category })` over the
  *             `health_signal` / `model_health` / `config_posture` rows (counts +
- *             labels only — the 160 rows already dropped raw bodies).
+ *             labels only — those rows already dropped raw bodies at write time).
  *
- * Determinism (X3): the report root carries NO wall-clock field — there is ONE
+ * Determinism: the report root carries NO wall-clock field — there is ONE
  * clock read (the injected `ClockPort.now()`), captured once and threaded as
- * BOTH the window start (`sinceHours -> sinceMs`) AND the A3 reader's window
+ * BOTH the window start (`sinceHours -> sinceMs`) AND the session-index reader's
+ * window
  * upper bound (`nowMs`). NEVER `Date.now()`/`new Date()` downstream (the globals
  * gate). Same injected clock + same data -> byte-identical report — true even
- * when the injected instant differs from real wall-clock (WR-01).
+ * when the injected instant differs from real wall-clock.
  *
  * Bounded (digest-only): `findings[]` is capped at {@link FLEET_FINDINGS_CAP}
  * (highest-count-first), recording the drop in `truncations[]` — the
- * `obs-explain-bound.ts` cap-then-record pattern, lighter because the 159 schema
- * + A2's top-3 cap already bound the rest.
+ * `obs-explain-bound.ts` cap-then-record pattern, lighter because the report
+ * schema + the reducer's top-3 cap already bound the rest.
  *
- * H1 dual-layer admin gate: the contract is `scopes:["admin"]` (gateway-router
+ * Dual-layer admin gate: the contract is `scopes:["admin"]` (gateway-router
  * primary) AND the handler re-checks `_trustLevel === "admin"` (defense-in-depth),
  * cloned verbatim from `obs-explain.ts`. `stripInternalFields` runs BEFORE the
  * contract parse so `_trustLevel` can never be smuggled into the parsed params or
@@ -51,22 +52,23 @@ import { type ObsHandlerDeps } from "./obs-helpers.js";
  * sources. NEITHER an admin check NOR a contract parse — it takes an
  * ALREADY-AUTHORIZED window and runs the deterministic read fan-in, so it can be
  * reached under daemon authority by a caller with its own authorization boundary
- * (the admin RPC handler keeps its admin gate; the Phase-161-02 MCP closure relies
+ * (the admin RPC handler keeps its admin gate; the MCP closure relies
  * on the per-client allowlist + the digest-only report).
  *
- * @param deps.obsStore - the observability store (A1/A2 + I-track). Soft-fail:
+ * @param deps.obsStore - the observability store (session rollups + diagnostics).
+ *   Soft-fail:
  *   absent yields an empty (but self-evidently empty, via coverage) report.
- * @param deps.dataDir - the data dir for the A3 session-index reader.
+ * @param deps.dataDir - the data dir for the session-index reader.
  * @param deps.clock - the injected ClockPort. The ONE clock read (for `sinceMs`);
  *   NEVER `Date.now()` (the globals gate).
- * @param deps.durableRuns - FLEET-01/02/04 (Phase 220-03): the durable-run store
+ * @param deps.durableRuns - the durable-run store
  *   for the autonomy block's run counts (`countByStatus(sinceMs)`). Soft-fail (the
  *   `obsStore?` precedent): absent ⇒ the autonomy block is honestly OMITTED (the
  *   daemon-less offline CLI / a non-durability boot). NO extra clock read — reuses
  *   the ONE `sinceMs` window.
  * @param sinceHours - the window size (the caller applies the 24h default). A
  *   non-finite or non-positive value is clamped to {@link DEFAULT_WINDOW_HOURS}
- *   here (IN-01 defense-in-depth) so a contract-bypassing caller cannot produce
+ *   here (defense-in-depth) so a contract-bypassing caller cannot produce
  *   a `-Infinity`/`NaN` window bound.
  */
 export declare function assembleFleetHealthReport(deps: {
@@ -76,13 +78,13 @@ export declare function assembleFleetHealthReport(deps: {
     durableRuns?: DurableRunPort;
 }, sinceHours: number): Promise<FleetHealthReport>;
 /**
- * Bind the `obs.fleet.health` handler — the H1 admin gate + strip-before-parse +
+ * Bind the `obs.fleet.health` handler — the admin gate + strip-before-parse +
  * the read fan-in. COMPUTED-KEY form (`[ObsFleetHealthContract.method]`) is
  * MANDATORY — `api-contracts-bidirectional.test.ts` only recognizes the computed
  * key, not a `"obs.fleet.health":` string literal.
  *
  * @param deps - the shared obs-handler deps; `deps.clock` is populated by
- *   `buildRpcDispatchDeps` in daemon.ts (Phase 161-02). The handler asserts
- *   `deps.clock!` because 161-02 always populates it.
+ *   `buildRpcDispatchDeps` in daemon.ts. The handler asserts
+ *   `deps.clock!` because that wiring always populates it.
  */
 export declare function bindFleetHealthHandlers(deps: ObsHandlerDeps): Record<string, RpcHandler>;