comisai 1.0.44 → 1.0.46

package/node_modules/@comis/daemon/dist/api/obs-handlers/fleet-health.js

@@ -1,37 +1,38 @@
 // SPDX-License-Identifier: Apache-2.0
 // @allow-throw: RPC handler module — all throws are caught and converted to JSON-RPC error responses by rpc-dispatch.ts.
 /**
- * `obs.fleet.health` RPC handler — the cross-session FleetHealthReport assembler
- * (Phase 161 R2 + H1). The SIBLING of `obs-explain.ts`: `obs.explain` post-mortems
+ * `obs.fleet.health` RPC handler — the cross-session FleetHealthReport assembler.
+ * The SIBLING of `obs-explain.ts`: `obs.explain` post-mortems
  * ONE session; this rolls up a WINDOW of sessions into a bounded, deterministic,
  * digest-only fleet triage.
  *
  * The assembler is a READ FAN-IN over four EXISTING, bounded, soft-fail sources
  * (the `assembleIncidentReportFromSources` shape — that reads 4 sources too):
  *
- *   A1 + A2 — `ObservabilityStore.aggregateSessionsInWindow(sinceMs)` ->
+ *   session rollup — `ObservabilityStore.aggregateSessionsInWindow(sinceMs)` ->
  *             `reduceFleetWindow` (pure cross-session reduce; synthetic excluded).
- *   A3      — `readSessionIndexWindow(dataDir, sinceMs, nowMs)` (multi-day
+ *   activity index — `readSessionIndexWindow(dataDir, sinceMs, nowMs)` (multi-day
  *             activity aggregate; `daysRead`/`daysMissing` feed the coverage
  *             honesty block). `nowMs` is the SAME injected instant as `sinceMs`,
- *             so the A3 day-key window tracks the injected clock (WR-01).
- *   I-track — `queryDiagnostics({ category })` over the Phase-160
+ *             so the session-index day-key window tracks the injected clock.
+ *   diagnostics — `queryDiagnostics({ category })` over the
  *             `health_signal` / `model_health` / `config_posture` rows (counts +
- *             labels only — the 160 rows already dropped raw bodies).
+ *             labels only — those rows already dropped raw bodies at write time).
  *
- * Determinism (X3): the report root carries NO wall-clock field — there is ONE
+ * Determinism: the report root carries NO wall-clock field — there is ONE
  * clock read (the injected `ClockPort.now()`), captured once and threaded as
- * BOTH the window start (`sinceHours -> sinceMs`) AND the A3 reader's window
+ * BOTH the window start (`sinceHours -> sinceMs`) AND the session-index reader's
+ * window
  * upper bound (`nowMs`). NEVER `Date.now()`/`new Date()` downstream (the globals
  * gate). Same injected clock + same data -> byte-identical report — true even
- * when the injected instant differs from real wall-clock (WR-01).
+ * when the injected instant differs from real wall-clock.
  *
  * Bounded (digest-only): `findings[]` is capped at {@link FLEET_FINDINGS_CAP}
  * (highest-count-first), recording the drop in `truncations[]` — the
- * `obs-explain-bound.ts` cap-then-record pattern, lighter because the 159 schema
- * + A2's top-3 cap already bound the rest.
+ * `obs-explain-bound.ts` cap-then-record pattern, lighter because the report
+ * schema + the reducer's top-3 cap already bound the rest.
  *
- * H1 dual-layer admin gate: the contract is `scopes:["admin"]` (gateway-router
+ * Dual-layer admin gate: the contract is `scopes:["admin"]` (gateway-router
  * primary) AND the handler re-checks `_trustLevel === "admin"` (defense-in-depth),
  * cloned verbatim from `obs-explain.ts`. `stripInternalFields` runs BEFORE the
  * contract parse so `_trustLevel` can never be smuggled into the parsed params or
@@ -53,6 +54,7 @@ import { IS_DEV } from "./obs-helpers.js";
 import { readSessionIndexWindow } from "./fleet-session-index.js";
 import { buildFindings, pipelineAuthoringAggregateFromRows } from "./fleet-findings.js";
 import { computeAutonomySlice } from "./fleet-autonomy.js";
+import { computeCronWakeGateSlice } from "./fleet-cron-wake-gate.js";
 /** Default data directory (lazy). Mirrors obs-explain.ts / fleet-session-index.ts. */
 function defaultDataDir() {
     return safePath(os.homedir(), ".comis");
@@ -62,9 +64,9 @@ const MS_PER_HOUR = 60 * 60 * 1000;
 const DEFAULT_WINDOW_HOURS = 24;
 /**
  * Max findings the report keeps — the bounding cap (highest-count-first). Mirrors
- * the obs-explain progressive-shed caps; the fleet report is small (the 159 schema
- * + A2's top-3 cap bound the rest) so the only array that can grow with WARN
- * volume is `findings[]`, derived from the I-track rows.
+ * the obs-explain progressive-shed caps; the fleet report is small (the schema
+ * + the reducer's top-3 cap bound the rest) so the only array that can grow with
+ * WARN volume is `findings[]`, derived from the diagnostic rows.
  */
 const FLEET_FINDINGS_CAP = 8;
 /**
@@ -79,13 +81,13 @@ const HIGH_DEGRADED_RATE = 0.5;
  * degradation outranks a single recurring WARN class.
  */
 const FLEET_HEURISTICS = [
-    // 0) FLEET-04 acute AUTONOMY degradation — an unattended run was orphaned on
+    // 0) Acute AUTONOMY degradation — an unattended run was orphaned on
     //    restart or revoked/killed. This outranks the session-level rules: an
     //    autonomy run that did not survive is the highest-priority unattended-mode
     //    signal, and it carries the worst `rootRunId` so the operator pastes it
-    //    straight into `comis explain` (the FLEET-05 root- arm). Clones the
-    //    fleet_acute_degradation shape (a named-cause acute event). NO clock read —
-    //    keys only on the assembled autonomy signals (determinism, T-220-12).
+    //    straight into `comis explain` (which resolves rootRunId references).
+    //    Clones the fleet_acute_degradation shape (a named-cause acute event).
+    //    NO clock read — keys only on the assembled autonomy signals (determinism).
     (s) => {
         if (s.autonomyDegradedCount === 0)
             return null;
@@ -117,7 +119,7 @@ const FLEET_HEURISTICS = [
             ],
         };
     },
-    // 2) Acute named degradation (W9 obs-llm-troubleshooting) — ANY degraded
+    // 2) Acute named degradation — ANY degraded
     //    session with a named cause outranks the chronic rules below. Posture is
     //    standing state; a degraded session is an event the operator must explain
     //    first. The live fleet verdict pointed at TLS-off (chronic, known) while
@@ -195,92 +197,99 @@ function boundFindings(findings, truncations) {
  * sources. NEITHER an admin check NOR a contract parse — it takes an
  * ALREADY-AUTHORIZED window and runs the deterministic read fan-in, so it can be
  * reached under daemon authority by a caller with its own authorization boundary
- * (the admin RPC handler keeps its admin gate; the Phase-161-02 MCP closure relies
+ * (the admin RPC handler keeps its admin gate; the MCP closure relies
  * on the per-client allowlist + the digest-only report).
  *
- * @param deps.obsStore - the observability store (A1/A2 + I-track). Soft-fail:
+ * @param deps.obsStore - the observability store (session rollups + diagnostics).
+ *   Soft-fail:
  *   absent yields an empty (but self-evidently empty, via coverage) report.
- * @param deps.dataDir - the data dir for the A3 session-index reader.
+ * @param deps.dataDir - the data dir for the session-index reader.
  * @param deps.clock - the injected ClockPort. The ONE clock read (for `sinceMs`);
  *   NEVER `Date.now()` (the globals gate).
- * @param deps.durableRuns - FLEET-01/02/04 (Phase 220-03): the durable-run store
+ * @param deps.durableRuns - the durable-run store
  *   for the autonomy block's run counts (`countByStatus(sinceMs)`). Soft-fail (the
  *   `obsStore?` precedent): absent ⇒ the autonomy block is honestly OMITTED (the
  *   daemon-less offline CLI / a non-durability boot). NO extra clock read — reuses
  *   the ONE `sinceMs` window.
  * @param sinceHours - the window size (the caller applies the 24h default). A
  *   non-finite or non-positive value is clamped to {@link DEFAULT_WINDOW_HOURS}
- *   here (IN-01 defense-in-depth) so a contract-bypassing caller cannot produce
+ *   here (defense-in-depth) so a contract-bypassing caller cannot produce
  *   a `-Infinity`/`NaN` window bound.
  */
 export async function assembleFleetHealthReport(deps, sinceHours) {
-    // IN-01 guard (defense-in-depth): the contract rejects a non-finite/non-positive
+    // Defense-in-depth guard: the contract rejects a non-finite/non-positive
     // sinceHours at the parse boundary, but the assembler is ALSO reachable directly
     // (the MCP closure) and a non-finite value here would yield sinceMs = -Infinity
-    // / NaN — a `-Infinity` SQL lower bound and a `RangeError` in the A3 day-key
+    // / NaN — a `-Infinity` SQL lower bound and a `RangeError` in the session-index
+    // day-key
     // derivation. Clamp anything non-finite or non-positive to the default window
     // so the assembler is robust regardless of the caller's validation.
     const windowHours = Number.isFinite(sinceHours) && sinceHours > 0 ? sinceHours : DEFAULT_WINDOW_HOURS;
     // The ONE clock read — captured ONCE and threaded through EVERY windowed
     // source so the whole report is deterministic w.r.t. the injected clock.
     // `windowHours -> sinceMs` (window start) + `nowMs` (window upper bound, passed
-    // to the A3 reader). NO Date.now()/new Date() anywhere downstream (WR-01).
+    // to the session-index reader). NO Date.now()/new Date() anywhere downstream.
     const nowMs = deps.clock.now();
     const sinceMs = nowMs - windowHours * MS_PER_HOUR;
-    // A1 + A2 — per-session rollups -> cross-session fleet rollup. `rows` is
+    // Session rollup — per-session rollups -> cross-session fleet rollup. `rows` is
     // `SessionSummaryRollup[]` (inferred from the store method's return type; the
     // type is not re-exported from @comis/memory, and reduceFleetWindow accepts it
     // structurally — no explicit annotation needed).
     const rows = deps.obsStore?.aggregateSessionsInWindow(sinceMs) ?? [];
     // Synthetic/test sessions are always excluded from this operator-facing fleet
-    // digest (WR-02): the prior `includeSynthetic` opt-in was unreachable from all
-    // four surfaces, so it was removed rather than left as a dead admin capability.
+    // digest: there is deliberately no `includeSynthetic` opt-in — none of the
+    // four surfaces could reach one, so it would be a dead admin capability.
     const fleet = reduceFleetWindow(rows, { excludeSynthetic: true });
-    // WR-01: the absolute degraded count comes from the SAME synthetic-excluded
+    // The absolute degraded count comes from the SAME synthetic-excluded
     // population the reducer used for `total` (sessionCount) + `degradedRate` —
-    // `fleet.degradedCount`, NOT a re-derivation over the UNFILTERED `rows`. The
-    // old `rows.filter(r => r.degraded).length` counted synthetic/test degraded
-    // rows too, so `sessions.degraded` could exceed `total`, disagree with
-    // `degradedRate`, and contradict `sum(degradedByCause)` (which the reducer
-    // already caps to runtime-only). Reading it back keeps all three `sessions`
-    // fields on one population. (`coverage.sessionSummary.rows` stays unfiltered
-    // below — that is a read-coverage breadcrumb, correct pre-exclusion.)
+    // `fleet.degradedCount`, NOT a re-derivation over the UNFILTERED `rows`.
+    // A `rows.filter(r => r.degraded).length` re-derivation would count
+    // synthetic/test degraded rows too, so `sessions.degraded` could exceed
+    // `total`, disagree with `degradedRate`, and contradict `sum(degradedByCause)`
+    // (which the reducer already caps to runtime-only). Reading it back keeps all
+    // three `sessions` fields on one population. (`coverage.sessionSummary.rows`
+    // stays unfiltered below — that is a read-coverage breadcrumb, correct
+    // pre-exclusion.)
     const degraded = fleet.degradedCount;
-    // A3 — multi-day session-index activity aggregate (daysRead/daysMissing -> coverage).
-    // Thread the SAME `nowMs` as the window upper bound so the A3 day-key range
-    // tracks the injected clock (WR-01), not a hidden second wall-clock read. The
-    // reader's own default excludes synthetic rows (WR-02 — no opt-in plumbed).
+    // Activity — multi-day session-index aggregate (daysRead/daysMissing -> coverage).
+    // Thread the SAME `nowMs` as the window upper bound so the day-key range
+    // tracks the injected clock, not a hidden second wall-clock read. The
+    // reader's own default excludes synthetic rows (no opt-in plumbed).
     const activity = readSessionIndexWindow(deps.dataDir, sinceMs, nowMs);
-    // I-track (Phase 160) — windowed health_signal; latest model_health / config_posture.
+    // Diagnostics — windowed health_signal; latest model_health / config_posture.
     const healthSignals = deps.obsStore?.queryDiagnostics({ category: "health_signal", sinceMs }) ?? [];
     const modelHealth = deps.obsStore?.queryDiagnostics({ category: "model_health", sinceMs }) ?? [];
     const configPosture = deps.obsStore?.queryDiagnostics({ category: "config_posture", sinceMs }) ?? [];
-    // OBS-3b (hindsight-reflection-20260626): the reflection funnel rows → the learning_health finding.
+    // The reflection funnel rows → the learning_health finding.
     const learningHealth = deps.obsStore?.queryDiagnostics({ category: "learning_health", sinceMs }) ?? [];
-    // OBS-2b (reflect-obs-20260627): the forget-sweep rows → the memory_lifecycle finding.
+    // The forget-sweep rows → the memory_lifecycle finding.
     const memoryLifecycle = deps.obsStore?.queryDiagnostics({ category: "memory_lifecycle", sinceMs }) ?? [];
-    // TELEM-02 — the pre-committed pipeline-authoring decision verdict (gates Phase
-    // 174). PURE + deterministic: the windowed pipeline_authoring rows -> the
-    // aggregate -> the gate. No-data -> defer. Structurally `{buildAuthor, reason}`,
-    // so it assigns into the core-schema-typed report field with no cast.
+    // The gated cron-fire rows → the cronWakeGate slice + rollup finding.
+    const cronWakeGate = deps.obsStore?.queryDiagnostics({ category: "cron_wake_gate", sinceMs }) ?? [];
+    // The pre-committed pipeline-authoring decision verdict (the gate metric for
+    // enabling small-model DAG authoring). PURE + deterministic: the windowed
+    // pipeline_authoring rows -> the aggregate -> the gate. No-data -> defer.
+    // Structurally `{buildAuthor, reason}`, so it assigns into the
+    // core-schema-typed report field with no cast.
     const pipelineAuthoringVerdict = pipelineAuthoringGate(pipelineAuthoringAggregateFromRows(healthSignals));
     // findings[] — counts + codes + hints ONLY (no raw bodies).
-    const allFindings = buildFindings(healthSignals, modelHealth, configPosture, learningHealth, memoryLifecycle);
+    const allFindings = buildFindings(healthSignals, modelHealth, configPosture, learningHealth, memoryLifecycle, cronWakeGate);
     const truncations = [];
     const findings = boundFindings(allFindings, truncations);
-    // topErrorKinds — Record -> [{kind,count}], already capped (top-3) + key-sorted by A2.
+    // topErrorKinds — Record -> [{kind,count}], already capped (top-3) + key-sorted by the reducer.
     const topErrorKinds = Object.entries(fleet.topErrorKinds).map(([kind, count]) => ({ kind, count }));
-    // FLEET-01/02/04 (Phase 220-03) — the AUTONOMY slice. autonomy runs ARE
+    // The AUTONOMY slice. autonomy runs ARE
     // durable_runs by construction, so the run counts come from the crash-surviving
     // DurableRunPort.countByStatus (NOT the session-rollup schema). Soft-fail read
     // (the getRollingSpendUsd / obsStore? precedent) — NO new clock read, reuse the
     // ONE `sinceMs` window. The resumed/killed counts + the worst rootRunId are
     // event-sourced from the `healthSignals` rows already read above (kill is
-    // separable from revoked ONLY because Plan 01 emits a distinct event). When the
+    // separable from revoked ONLY because the runtime emits a distinct
+    // autonomy_killed event). When the
     // store is unwired AND no autonomy rows exist, the block is OMITTED (honest
     // degradation — offline CLI). The whole slice reads only assembled signals +
-    // the synthetic-excluded `fleet` read-back — NO Date.now()/new Date() (T-220-12),
-    // NO re-derivation over raw `rows` (T-220-11 / WR-01).
+    // the synthetic-excluded `fleet` read-back — NO Date.now()/new Date(),
+    // NO re-derivation over raw `rows`.
     // Soft-fail read of the crash-surviving counts (the getRollingSpendUsd precedent):
     // the Result is narrowed on `.ok` — a read error degrades to `undefined` (the block
     // is then driven by the event-sourced rows / omitted), never throws.
@@ -289,31 +298,41 @@ export async function assembleFleetHealthReport(deps, sinceHours) {
     const autonomy = computeAutonomySlice({
         durableCounts,
         healthSignals,
-        // FLEET-02: breaker trips read back the synthetic-excluded windowed breakerTripTotal
+        // Breaker trips read back the synthetic-excluded windowed breakerTripTotal
         // (summed from per-session breakerTripCount in reduceFleetWindow) — NEVER re-derived over
         // raw rows. NOT degradedByCause["denial_breaker"]: denial_breaker is an execution:aborted
         // EVENT reason, never a session endReason (END_REASON_MAP has no such key), so that bucket
-        // is always 0 (WR-01). breakerTripTotal is the real, populated source; breaker trips are an
-        // autonomy-only mechanism (Phase 217), so the window total IS the autonomy-scoped count.
+        // is always 0. breakerTripTotal is the real, populated source; breaker trips are an
+        // autonomy-only mechanism, so the window total IS the autonomy-scoped count.
         breakerTrips: fleet.breakerTripTotal ?? 0,
-        // FLEET-01: the window's autonomy-inclusive operator cost (the synthetic-excluded
+        // The window's autonomy-inclusive operator cost (the synthetic-excluded
         // read-back — documented in the schema; a stricter autonomy-only cost is a follow-up).
         costUsd: fleet.costUsd,
     });
+    // The cross-session wake-gate efficiency slice (per-agent skip-rate /
+    // turns-saved / net cost). PURE over the already-read `cron_wake_gate` rows;
+    // `undefined` (block omitted) when no gated fire is in the window — honest
+    // degradation, mirroring the autonomy slice's honest-omit.
+    const cronWakeGateSlice = computeCronWakeGateSlice(cronWakeGate);
     // The deterministic verdict (PURE, ordered first-match-wins).
-    // W9: dominant named degradation cause (highest count; lexicographic tiebreak).
+    // Dominant named degradation cause (highest count; lexicographic tiebreak).
     const topDegradedCause = Object.entries(fleet.degradedByCause).sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0]))[0]?.[0];
     const likelyRootCause = fleetRootCause({
         degradedRate: fleet.degradedRate,
         sessionCount: fleet.sessionCount,
         degradedCount: degraded,
         ...(topDegradedCause !== undefined ? { topDegradedCause } : {}),
-        healthSignalCount: healthSignals.length,
+        // Count only degraded (warning+) rows: the ingest layer stamps benign
+        // reasons (session_rebase / serialized_wait) severity "info", and counting
+        // them here made a healthy fleet root-cause to "recurring health WARN
+        // signal(s)" off once-per-session-start rebases — the same severity
+        // discipline the findings rollup applies.
+        healthSignalCount: healthSignals.filter((r) => r.severity !== "info").length,
         configPostureCount: configPosture.length,
         topErrorKind: topErrorKinds[0]?.kind,
-        // FLEET-04: the autonomy verdict keys on the DEGRADED autonomy run count +
+        // The autonomy verdict keys on the DEGRADED autonomy run count +
         // the worst rootRunId (both from the slice above) — undefined-safe spread.
-        // FLEET-02: a denial-breaker-aborted run lands in durable status 'completed'
+        // A denial-breaker-aborted run lands in durable status 'completed'
         // (NOT orphaned/revoked), so it is invisible to `runs.degraded` — but it IS a
         // degraded autonomy event (the run burned its denial budget and was force-
         // aborted). Add `denialBreakerTrips` so the verdict fires + surfaces the worst
@@ -332,18 +351,19 @@ export async function assembleFleetHealthReport(deps, sinceHours) {
         windowHours,
         sessions: { total: fleet.sessionCount, degraded, degradedRate: fleet.degradedRate },
         topErrorKinds,
-        // QT2/QT3 — the fleet-level degradation detector: degraded counts by named
+        // The fleet-level degradation detector: degraded counts by named
         // endReason cause, computed by reduceFleetWindow from the per-session rows
         // (bounded + deterministic; synthetic excluded by the reducer above).
         degradedByCause: fleet.degradedByCause,
         breakerTripTotal: fleet.breakerTripTotal,
         toolStats: fleet.toolStats,
-        // WR-03 — cost is CROSS-SOURCE and degrades asymmetrically: `costUsd` is
-        // A1-sourced (the session-summary store) while `totalTokens` is A3-sourced
+        // Cost is CROSS-SOURCE and degrades asymmetrically: `costUsd` is
+        // store-sourced (the session-summary rollup) while `totalTokens` is
+        // index-sourced
         // (`activity.tokenTotal`, the session-index files). So `totalTokens` may be
-        // 0 even when `costUsd` is non-zero whenever A3 reads degrade
+        // 0 even when `costUsd` is non-zero whenever the session-index reads degrade
         // (`coverage.sessionIndex.daysMissing > 0`). `cost.totalTokens` is the SAME
-        // figure as `activity.tokenTotal` (single A3 source of truth — no second
+        // figure as `activity.tokenTotal` (a single source of truth — no second
         // aggregate); consumers cross-reference `coverage` before trusting a 0. The
         // `comis fleet` table render drops the misleading "· 0 tok" in that case.
         cost: { costUsd: fleet.costUsd, totalTokens: activity.tokenTotal },
@@ -356,15 +376,20 @@ export async function assembleFleetHealthReport(deps, sinceHours) {
         },
         findings,
         likelyRootCause,
-        // TELEM-02 — the pipeline-authoring gate verdict (declared in
+        // The pipeline-authoring gate verdict (declared in
         // FleetHealthReportSchema so .parse() preserves it; rides the existing
         // admin-gated obs.fleet.health — no new RPC surface).
         pipelineAuthoringGate: pipelineAuthoringVerdict,
-        // FLEET-01/02/04 — the autonomy block (counts + the worst rootRunId ONLY).
+        // The autonomy block (counts + the worst rootRunId ONLY).
         // Conditionally spread so an offline/non-durability boot with no autonomy
         // signals OMITS the field entirely (honest degradation; the schema field is
         // optional, so an absent block round-trips). Present otherwise.
         ...(autonomy !== undefined ? { autonomy } : {}),
+        // The wake-gate efficiency block (per-agent skip-rate + net cost).
+        // Conditionally spread so a window with no gated fire OMITS the field entirely
+        // (honest degradation; the schema field is optional, so an absent block
+        // round-trips). Present otherwise.
+        ...(cronWakeGateSlice !== undefined ? { cronWakeGate: cronWakeGateSlice } : {}),
         suggestedNextSteps,
         truncations,
         coverage: {
@@ -375,20 +400,20 @@ export async function assembleFleetHealthReport(deps, sinceHours) {
     };
 }
 /**
- * Bind the `obs.fleet.health` handler — the H1 admin gate + strip-before-parse +
+ * Bind the `obs.fleet.health` handler — the admin gate + strip-before-parse +
  * the read fan-in. COMPUTED-KEY form (`[ObsFleetHealthContract.method]`) is
  * MANDATORY — `api-contracts-bidirectional.test.ts` only recognizes the computed
  * key, not a `"obs.fleet.health":` string literal.
  *
  * @param deps - the shared obs-handler deps; `deps.clock` is populated by
- *   `buildRpcDispatchDeps` in daemon.ts (Phase 161-02). The handler asserts
- *   `deps.clock!` because 161-02 always populates it.
+ *   `buildRpcDispatchDeps` in daemon.ts. The handler asserts
+ *   `deps.clock!` because that wiring always populates it.
  */
 export function bindFleetHealthHandlers(deps) {
     const dataDir = deps.dataDir ?? defaultDataDir();
     return {
         [ObsFleetHealthContract.method]: async (rawParams) => {
-            // H1: admin check (defense-in-depth; gateway-router is the primary gate).
+            // Admin check (defense-in-depth; gateway-router is the primary gate).
             const trustLevel = rawParams._trustLevel;
             if (trustLevel !== "admin")
                 throw new AuthorizationError("Admin access required");
@@ -396,7 +421,7 @@ export function bindFleetHealthHandlers(deps) {
             // smuggled into the parsed params or the report.
             const params = ObsFleetHealthContract.request.parse(stripInternalFields(rawParams));
             const report = await assembleFleetHealthReport(
-            // FLEET-01/02/04: thread durableRuns for the autonomy block. Populated by
+            // Thread durableRuns for the autonomy block. Populated by
             // buildRpcDispatchDeps (daemon.ts:893, `durableRuns: c.durableRunStore`) on
             // the SAME ObservabilityApiDeps object as obsStore/clock; absent ⇒ honest
             // degradation (the block is omitted).

package/node_modules/@comis/daemon/dist/api/obs-handlers/fleet-session-index.d.ts

@@ -1,5 +1,5 @@
 /**
- * `readSessionIndexWindow` — the A3 multi-day session-index aggregate reader.
+ * `readSessionIndexWindow` — the multi-day session-index aggregate reader.
  *
  * The activity half of the fleet lens. It generalizes the single-traceId
  * `resolveTraceToSession` (`obs-explain-resolve.ts`, which reads a 2-day horizon
@@ -14,20 +14,20 @@
  *   - turn / token totals        ← per-session dedup of `session_ended` (authoritative)
  *                                    + `turn_completed` (in-flight fallback)
  *
- * Source of the totals (the note for the Phase-161 FleetHealthReport handler):
+ * Source of the totals (the note for the FleetHealthReport handler):
  * the reader prefers the `session_ended` rows as the AUTHORITATIVE session-level
  * totals (one ended row carries the whole session's `turnCount`/`totalTokens`).
  * For a session that has NO end row yet (an in-flight session — the dominant
  * live case, e.g. a long-lived chat-API session that never destroys), it sums
  * the per-turn `turn_completed.inputTokens + outputTokens` instead. The two are
  * de-duped PER sessionId: a session that DOES have an end row uses the ended
- * totals only (never the live sum), so neither path double-counts. The v1 reader
- * summed only `session_ended` and silently reported 0 turns / 0 tokens for every
+ * totals only (never the live sum), so neither path double-counts. Summing only
+ * `session_ended` would silently report 0 turns / 0 tokens for every
  * still-open session — including the busiest one on most fleets. The reader
- * exposes `daysRead` / `daysMissing` so the R1 coverage block can report an
+ * exposes `daysRead` / `daysMissing` so the coverage block can report an
  * honest partial read.
  *
- * Provenance: `synthetic === true` rows (D9 harness/bench/test sessions) are
+ * Provenance: `synthetic === true` rows (harness/bench/test sessions) are
  * excluded by default — a REAL filter (the field IS present on session-index
  * rows, unlike the diagnostics row). `{ includeSynthetic: true }` is the admin
  * opt-in. The exclusion mirrors the `obs-explain-resolve.ts:81` precedent.
@@ -37,8 +37,8 @@
  *     ESLint-banned); the day-key is a fixed `YYYY-MM-DD` derived from
  *     `systemDateFrom`, never a row field — no user-controlled path component.
  *   - Time: the window upper bound is the INJECTED `nowMs` (the caller's single
- *     clock instant) — so the day-key range is deterministic w.r.t. that clock
- *     (WR-01). It defaults to the sanctioned-root `systemNowMs()` only for
+ *     clock instant) — so the day-key range is deterministic w.r.t. that clock.
+ *     It defaults to the sanctioned-root `systemNowMs()` only for
  *     callers with no clock seam; day-keys are `systemDateFrom(...)` strings,
  *     NEVER `new Date()` / a raw `Date.now()` (the globals gate).
  *   - All reads soft-fail (`continue`, never throw): a missing day-file
@@ -55,14 +55,14 @@
  * soft-fail silently and take no `Deps`/logger). These are pure functional
  * file readers with no injection seam, and importing `@comis/infra` directly is
  * banned (AGENTS §2.4). The soft-fail signal is surfaced STRUCTURALLY via the
- * `daysRead` / `daysMissing` counters the R1 coverage block consumes; the
- * Phase-161 RPC handler logs at the boundary where it has the `Deps` seam.
+ * `daysRead` / `daysMissing` counters the coverage block consumes; the
+ * RPC handler logs at the boundary where it has the `Deps` seam.
  *
  * @module
  */
 /**
  * The windowed session-index aggregate. Counts + distinct sets only — no
- * message bodies, no per-session detail (the report is digest-only, V8).
+ * message bodies, no per-session detail (the report is digest-only).
  */
 export interface FleetSessionIndexSummary {
     /** Distinct `agentId`s seen in `session_started` rows, sorted for determinism. */
@@ -90,10 +90,10 @@ export interface FleetSessionIndexSummary {
  *   `MAX_DAYS`).
  * @param nowMs - epoch-ms window UPPER bound (the day-key range end). Pass the
  *   caller's injected clock instant so the window is deterministic w.r.t. that
- *   clock (WR-01). Defaults to the sanctioned-root `systemNowMs()` for callers
+ *   clock. Defaults to the sanctioned-root `systemNowMs()` for callers
  *   that genuinely have no clock seam.
  * @param opts.includeSynthetic - when `false` (the default), rows stamped
- *   `synthetic === true` are excluded from every aggregate (D9). `true` includes
+ *   `synthetic === true` are excluded from every aggregate. `true` includes
  *   them (the admin opt-in).
  * @returns the windowed aggregate. Never throws — missing/unreadable/malformed
  *   input soft-fails and is reflected in `daysRead` / `daysMissing`.

package/node_modules/@comis/daemon/dist/api/obs-handlers/fleet-session-index.js

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: Apache-2.0
 // @allow-throw: RPC handler module — all throws are caught and converted to JSON-RPC error responses by rpc-dispatch.ts.
 /**
- * `readSessionIndexWindow` — the A3 multi-day session-index aggregate reader.
+ * `readSessionIndexWindow` — the multi-day session-index aggregate reader.
  *
  * The activity half of the fleet lens. It generalizes the single-traceId
  * `resolveTraceToSession` (`obs-explain-resolve.ts`, which reads a 2-day horizon
@@ -16,20 +16,20 @@
  *   - turn / token totals        ← per-session dedup of `session_ended` (authoritative)
  *                                    + `turn_completed` (in-flight fallback)
  *
- * Source of the totals (the note for the Phase-161 FleetHealthReport handler):
+ * Source of the totals (the note for the FleetHealthReport handler):
  * the reader prefers the `session_ended` rows as the AUTHORITATIVE session-level
  * totals (one ended row carries the whole session's `turnCount`/`totalTokens`).
  * For a session that has NO end row yet (an in-flight session — the dominant
  * live case, e.g. a long-lived chat-API session that never destroys), it sums
  * the per-turn `turn_completed.inputTokens + outputTokens` instead. The two are
  * de-duped PER sessionId: a session that DOES have an end row uses the ended
- * totals only (never the live sum), so neither path double-counts. The v1 reader
- * summed only `session_ended` and silently reported 0 turns / 0 tokens for every
+ * totals only (never the live sum), so neither path double-counts. Summing only
+ * `session_ended` would silently report 0 turns / 0 tokens for every
  * still-open session — including the busiest one on most fleets. The reader
- * exposes `daysRead` / `daysMissing` so the R1 coverage block can report an
+ * exposes `daysRead` / `daysMissing` so the coverage block can report an
  * honest partial read.
  *
- * Provenance: `synthetic === true` rows (D9 harness/bench/test sessions) are
+ * Provenance: `synthetic === true` rows (harness/bench/test sessions) are
  * excluded by default — a REAL filter (the field IS present on session-index
  * rows, unlike the diagnostics row). `{ includeSynthetic: true }` is the admin
  * opt-in. The exclusion mirrors the `obs-explain-resolve.ts:81` precedent.
@@ -39,8 +39,8 @@
  *     ESLint-banned); the day-key is a fixed `YYYY-MM-DD` derived from
  *     `systemDateFrom`, never a row field — no user-controlled path component.
  *   - Time: the window upper bound is the INJECTED `nowMs` (the caller's single
- *     clock instant) — so the day-key range is deterministic w.r.t. that clock
- *     (WR-01). It defaults to the sanctioned-root `systemNowMs()` only for
+ *     clock instant) — so the day-key range is deterministic w.r.t. that clock.
+ *     It defaults to the sanctioned-root `systemNowMs()` only for
  *     callers with no clock seam; day-keys are `systemDateFrom(...)` strings,
  *     NEVER `new Date()` / a raw `Date.now()` (the globals gate).
  *   - All reads soft-fail (`continue`, never throw): a missing day-file
@@ -57,8 +57,8 @@
  * soft-fail silently and take no `Deps`/logger). These are pure functional
  * file readers with no injection seam, and importing `@comis/infra` directly is
  * banned (AGENTS §2.4). The soft-fail signal is surfaced STRUCTURALLY via the
- * `daysRead` / `daysMissing` counters the R1 coverage block consumes; the
- * Phase-161 RPC handler logs at the boundary where it has the `Deps` seam.
+ * `daysRead` / `daysMissing` counters the coverage block consumes; the
+ * RPC handler logs at the boundary where it has the `Deps` seam.
  *
  * @module
  */
@@ -122,10 +122,10 @@ function dayKeysInWindow(sinceMs, nowMs) {
  *   `MAX_DAYS`).
  * @param nowMs - epoch-ms window UPPER bound (the day-key range end). Pass the
  *   caller's injected clock instant so the window is deterministic w.r.t. that
- *   clock (WR-01). Defaults to the sanctioned-root `systemNowMs()` for callers
+ *   clock. Defaults to the sanctioned-root `systemNowMs()` for callers
  *   that genuinely have no clock seam.
  * @param opts.includeSynthetic - when `false` (the default), rows stamped
- *   `synthetic === true` are excluded from every aggregate (D9). `true` includes
+ *   `synthetic === true` are excluded from every aggregate. `true` includes
  *   them (the admin opt-in).
  * @returns the windowed aggregate. Never throws — missing/unreadable/malformed
  *   input soft-fails and is reflected in `daysRead` / `daysMissing`.
@@ -146,8 +146,8 @@ export function readSessionIndexWindow(dataDir, sinceMs, nowMs = systemNowMs(),
     // session) only ever emits `turn_completed` rows. We accumulate BOTH per
     // sessionId and, at the end, prefer the authoritative ended totals when present
     // and fall back to the summed live turns otherwise — so neither is dropped nor
-    // double-counted (the v1 reader summed only ended rows, silently reporting 0
-    // turns / 0 tokens for every still-open session).
+    // double-counted (summing only ended rows would silently report 0 turns /
+    // 0 tokens for every still-open session).
     const endedSessions = new Set();
     const endedTurns = new Map();
     const endedTokens = new Map();
@@ -189,7 +189,7 @@ export function readSessionIndexWindow(dataDir, sinceMs, nowMs = systemNowMs(),
                 continue; // Skip malformed JSONL lines per the standard convention.
             }
             linesRead += 1;
-            // F-OBS-1b (30uc-20260624): window by the ROW ts, not just the day-key.
+            // Window by the ROW ts, not just the day-key.
             // The day-keyed files are whole-DAY; a `--since 1h` window opens today's
             // file and (pre-fix) counted EVERY session_started channel/agent in it
             // regardless of ts — so a 1-session window reported 39 channels + a
@@ -199,7 +199,7 @@ export function readSessionIndexWindow(dataDir, sinceMs, nowMs = systemNowMs(),
             const rowTsMs = typeof rec.ts === "string" ? Date.parse(rec.ts) : Number.NaN;
             if (Number.isFinite(rowTsMs) && (rowTsMs < sinceMs || rowTsMs > nowMs))
                 continue;
-            // D9 default-exclude — a REAL filter (strict === true; a string "true"
+            // Synthetic default-exclude — a REAL filter (strict === true; a string "true"
             // must NOT truthy-coerce into a spurious exclusion of a real session).
             if (rec.synthetic === true && !includeSynthetic)
                 continue;

package/node_modules/@comis/daemon/dist/api/obs-handlers/index.js

@@ -8,35 +8,35 @@
  *
  * @module
  */
-// The shared obs.explain assembler + its production reader (154-03). Re-exported
+// The shared obs.explain assembler + its production reader. Re-exported
 // so the daemon composition root can build the trust-flag-FREE
 // obsExplainForMcpClient closure over the SAME assembler the admin RPC handler
 // delegates to (the obs_explain MCP tool runs it directly under daemon
 // authority — no admin RPC, no admin trust).
 export { assembleIncidentReportFromSources, } from "./obs-explain.js";
 export { makeRealReader } from "./obs-explain-readers.js";
-// A3 (159-03): the multi-day session-index aggregate reader — the activity half
+// The multi-day session-index aggregate reader — the activity half
 // of the fleet lens. Generalizes the single-traceId resolveTraceToSession into a
 // windowed aggregate over <dataDir>/logs/session-index.*.jsonl. Re-exported so
-// the Phase-161 obs.fleet.health handler can assemble it alongside A1/A2.
+// the obs.fleet.health handler can assemble it alongside the other aggregates.
 export { readSessionIndexWindow, } from "./fleet-session-index.js";
-// The obs.fleet.health assembler (161-01). Re-exported so the daemon composition
-// root (161-02) can build the trust-flag-FREE obsFleetHealthForMcpClient closure
+// The obs.fleet.health assembler. Re-exported so the daemon composition
+// root can build the trust-flag-FREE obsFleetHealthForMcpClient closure
 // over the SAME assembler the admin RPC handler delegates to — mirroring the
 // assembleIncidentReportFromSources re-export above (the obs_fleet_health MCP tool
 // runs it directly under daemon authority; no admin RPC, no admin trust).
 export { assembleFleetHealthReport } from "./fleet-health.js";
-// The obs.audit.query binder (AUDIT-05, 176-05). Re-exported for symmetry with
+// The obs.audit.query binder. Re-exported for symmetry with
 // the other obs-handler slices; the daemon composition root spreads it into
 // createObsHandlers below (no separate MCP closure — the audit query is an
 // admin-RPC-only read surface, not an operator-allowlisted MCP tool).
 export { bindObsAuditHandlers } from "./obs-audit.js";
-// The obs.cacheBreaks.byReason binder (WEBUI-02, 179-04). Re-exported for symmetry
+// The obs.cacheBreaks.byReason binder. Re-exported for symmetry
 // with the other obs-handler slices; the daemon composition root spreads it into
 // createObsHandlers below (admin-RPC-only read surface, no MCP closure).
 export { bindObsCacheBreaksHandlers } from "./obs-cache-breaks.js";
-// The obs.spend.snapshot binder (WEBUI-02, 179-04). Reads the LIVE spend snapshot
-// threaded into the obs deps (locked A1); admin-RPC-only read surface.
+// The obs.spend.snapshot binder. Reads the LIVE spend snapshot
+// threaded into the obs deps; admin-RPC-only read surface.
 export { bindObsSpendHandlers } from "./obs-spend.js";
 import { bindObsMetricsHandlers } from "./obs-metrics.js";
 import { bindObsDiagnosticsHandlers } from "./obs-diagnostics.js";