comisai 1.0.44 → 1.0.46

package/node_modules/@comis/daemon/dist/graph/graph-durable-checkpoint.d.ts

@@ -1,26 +1,26 @@
 /**
- * DAG durable-checkpoint serialization (Phase 216, Plan 11, DUR-01/DUR-02).
+ * DAG durable-checkpoint serialization.
  *
  * A graph (DAG) run is made durable at NODE-boundary granularity: at every node
  * transition the coordinator persists the node-completion state of its
  * {@link GraphExecutionSnapshot} into the durable run record's `spawn_tree`
- * column (a JSON array — Plan 02), keyed on the graph's tree-stable
- * `graphRootRunId` (Phase 213 CR-01). On a daemon restart the resume engine
- * re-enters ONLY the nodes that were NOT terminal at crash time.
+ * column (a JSON array), keyed on the graph's tree-stable `graphRootRunId`. On
+ * a daemon restart the resume engine re-enters ONLY the nodes that were NOT
+ * terminal at crash time.
  *
  * These two functions are the pure, I/O-free core of that mechanism:
  *   - {@link snapshotToSpawnTree} serializes a live snapshot to the DAG
- *     `{nodeId,status,runId?}[]` shape (the LOW-2 discriminator — object entries
- *     with a `status` field mark a DAG record vs a flat run's `string[]`, so a
- *     flat run never mis-routes to `resumeGraph`).
+ *     `{nodeId,status,runId?}[]` shape (the DAG-vs-flat discriminator — object
+ *     entries with a `status` field mark a DAG record vs a flat run's
+ *     `string[]`, so a flat run never mis-routes to `resumeGraph`).
  *   - {@link incompleteNodes} is the resume selector: the nodes whose status is
  *     NOT in {@link TERMINAL_NODE_STATES} — the frontier to re-run.
  *
- * NODE-BOUNDARY GRANULARITY (Open Question 3, RESOLVED): a node that was
- * mid-execution (`running`) at crash time is treated as incomplete and re-run
- * from its start; its outward sends are deduped by the ONCE ledger (a committed
- * `(rootRunId, stepIndex)` is a no-op — Plans 05/07), so re-running is
- * exactly-once-safe WITHOUT persisting intra-node LLM/tool state (out of scope).
+ * NODE-BOUNDARY GRANULARITY: a node that was mid-execution (`running`) at crash
+ * time is treated as incomplete and re-run from its start; its outward sends
+ * are deduped by the ONCE ledger (a committed `(rootRunId, stepIndex)` is a
+ * no-op), so re-running is exactly-once-safe WITHOUT persisting intra-node
+ * LLM/tool state (out of scope).
  *
  * @module
  */
@@ -66,11 +66,11 @@ export declare function incompleteNodes(spawnTree: ReadonlyArray<{
     status: string;
 }>): string[];
 /**
- * The LOW-2 DAG-vs-flat discriminator (the resume engine's dispatch routing,
- * Plan 12). A DAG/graph run's `spawn_tree` entries are OBJECTS carrying a
+ * The DAG-vs-flat discriminator for the resume engine's dispatch routing.
+ * A DAG/graph run's `spawn_tree` entries are OBJECTS carrying a
  * `status` field (`{nodeId,status,runId?}` — the {@link snapshotToSpawnTree}
  * shape); a FLAT sub-agent run's `spawn_tree` is a plain `string[]` of node/lease
- * ids (Plan 01 `spawnTree: z.array(z.string())`). This is the EXPLICIT
+ * ids (the flat `spawnTree: z.array(z.string())` shape). This is the EXPLICIT
  * entry-has-`status` check — NOT a length or array-type heuristic — so the resume
  * engine routes to `coordinator.resumeGraph` IFF this returns true. A flat run
  * (string entries) can therefore NEVER mis-route to the graph resume, and a DAG

package/node_modules/@comis/daemon/dist/graph/graph-durable-checkpoint.js

@@ -1,27 +1,27 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * DAG durable-checkpoint serialization (Phase 216, Plan 11, DUR-01/DUR-02).
+ * DAG durable-checkpoint serialization.
  *
  * A graph (DAG) run is made durable at NODE-boundary granularity: at every node
  * transition the coordinator persists the node-completion state of its
  * {@link GraphExecutionSnapshot} into the durable run record's `spawn_tree`
- * column (a JSON array — Plan 02), keyed on the graph's tree-stable
- * `graphRootRunId` (Phase 213 CR-01). On a daemon restart the resume engine
- * re-enters ONLY the nodes that were NOT terminal at crash time.
+ * column (a JSON array), keyed on the graph's tree-stable `graphRootRunId`. On
+ * a daemon restart the resume engine re-enters ONLY the nodes that were NOT
+ * terminal at crash time.
  *
  * These two functions are the pure, I/O-free core of that mechanism:
  *   - {@link snapshotToSpawnTree} serializes a live snapshot to the DAG
- *     `{nodeId,status,runId?}[]` shape (the LOW-2 discriminator — object entries
- *     with a `status` field mark a DAG record vs a flat run's `string[]`, so a
- *     flat run never mis-routes to `resumeGraph`).
+ *     `{nodeId,status,runId?}[]` shape (the DAG-vs-flat discriminator — object
+ *     entries with a `status` field mark a DAG record vs a flat run's
+ *     `string[]`, so a flat run never mis-routes to `resumeGraph`).
  *   - {@link incompleteNodes} is the resume selector: the nodes whose status is
  *     NOT in {@link TERMINAL_NODE_STATES} — the frontier to re-run.
  *
- * NODE-BOUNDARY GRANULARITY (Open Question 3, RESOLVED): a node that was
- * mid-execution (`running`) at crash time is treated as incomplete and re-run
- * from its start; its outward sends are deduped by the ONCE ledger (a committed
- * `(rootRunId, stepIndex)` is a no-op — Plans 05/07), so re-running is
- * exactly-once-safe WITHOUT persisting intra-node LLM/tool state (out of scope).
+ * NODE-BOUNDARY GRANULARITY: a node that was mid-execution (`running`) at crash
+ * time is treated as incomplete and re-run from its start; its outward sends
+ * are deduped by the ONCE ledger (a committed `(rootRunId, stepIndex)` is a
+ * no-op), so re-running is exactly-once-safe WITHOUT persisting intra-node
+ * LLM/tool state (out of scope).
  *
  * @module
  */
@@ -72,11 +72,11 @@ export function incompleteNodes(spawnTree) {
         .map((entry) => entry.nodeId);
 }
 /**
- * The LOW-2 DAG-vs-flat discriminator (the resume engine's dispatch routing,
- * Plan 12). A DAG/graph run's `spawn_tree` entries are OBJECTS carrying a
+ * The DAG-vs-flat discriminator for the resume engine's dispatch routing.
+ * A DAG/graph run's `spawn_tree` entries are OBJECTS carrying a
  * `status` field (`{nodeId,status,runId?}` — the {@link snapshotToSpawnTree}
  * shape); a FLAT sub-agent run's `spawn_tree` is a plain `string[]` of node/lease
- * ids (Plan 01 `spawnTree: z.array(z.string())`). This is the EXPLICIT
+ * ids (the flat `spawnTree: z.array(z.string())` shape). This is the EXPLICIT
  * entry-has-`status` check — NOT a length or array-type heuristic — so the resume
  * engine routes to `coordinator.resumeGraph` IFF this returns true. A flat run
  * (string entries) can therefore NEVER mis-route to the graph resume, and a DAG

package/node_modules/@comis/daemon/dist/graph/graph-node-budget.d.ts

@@ -1,20 +1,20 @@
 /**
- * Per-node token-budget accounting for the graph coordinator (BUDGET-02/03).
+ * Per-node token-budget accounting for the graph coordinator.
  *
  * Two concerns, extracted from graph-node-lifecycle to keep that file within the
  * 800-line cap and to give the budget logic a cohesive, directly-testable home:
  *
  * - {@link resolveNodeBudget} — the effective per-node cap (node.tokenBudget wins;
- *   else the operator default; else the graph-budget inherit-share). D3.
+ *   else the operator default; else the graph-budget inherit-share).
  * - {@link applyNodeBudgetBreach} — records per-node spend, and when the node's run
- *   exceeded its cap, fails the node TERMINALLY (D2, bypassing retry), emits the
- *   counts/ids-only `subagent:budget_exceeded` event (M3: attributed to the node's
+ *   exceeded its cap, fails the node TERMINALLY (bypassing retry), emits the
+ *   counts/ids-only `subagent:budget_exceeded` event (attributed to the node's
  *   CHILD agent), and WARNs with an operator-actionable hint. It NEVER aborts the
  *   whole graph — the cumulative abort (graph-completion.handleBudgetExceeded) is a
- *   separate, later line that runs node-first (D5).
+ *   separate, later line that runs node-first.
  *
- * The no-budget path is byte-identical to today: `resolveNodeBudget` returns
- * undefined, so `applyNodeBudgetBreach` records spend and takes no breach branch.
+ * On the no-budget path `resolveNodeBudget` returns undefined, so
+ * `applyNodeBudgetBreach` records spend and takes no breach branch.
  * @module
  */
 import { type TypedEventBus } from "@comis/core";
@@ -22,12 +22,12 @@ import type { FailureResult } from "./graph-state-machine.js";
 import type { GraphRunState } from "./graph-coordinator-state.js";
 /**
  * Resolve the effective per-node token budget for a node.
- * Precedence (D3):
+ * Precedence:
  *  1. `node.tokenBudget` (the graph author's explicit per-node cap) wins.
  *  2. else the operator default `security.agentToAgent.tokenBudget`
  *     (`subAgentTokenBudget`, when not null).
  *  3. else the inherit-share `floor(graphBudget.maxTokens / total node count)`
- *     ONLY when a graph budget is set. WR-01: clamped to >= 1 — when maxTokens
+ *     ONLY when a graph budget is set. Clamped to >= 1 — when maxTokens
  *     < nodeCount the raw floor is 0, which would brick the node (checkBudget
  *     breaches on the first call; applyNodeBudgetBreach terminal-fails it). A
  *     clamp to 1 yields a tight-but-usable cap, never a silent all-nodes-brick.
@@ -35,16 +35,16 @@ import type { GraphRunState } from "./graph-coordinator-state.js";
  */
 export declare function resolveNodeBudget(gs: GraphRunState, nodeId: string, subAgentTokenBudget: number | null): number | undefined;
 /**
- * IN-02: which resolution source produced a node's effective per-node cap (D3).
+ * Which resolution source produced a node's effective per-node cap.
  * A closed union mirrored onto the `subagent:budget_exceeded` event payload so a
  * breach names WHICH knob bound the node.
  */
 export type NodeBudgetSource = "node" | "operator-default" | "inherit-share";
 /**
- * Resolve the effective per-node budget AND the source that produced it (D3).
+ * Resolve the effective per-node budget AND the source that produced it.
  * Single source of truth for the precedence; {@link resolveNodeBudget} returns
  * just the number, {@link applyNodeBudgetBreach} also reports `source` so the
- * breach event/WARN name the exact resolution knob (IN-02). `source` is
+ * breach event/WARN name the exact resolution knob. `source` is
  * `undefined` only when `budget` is `undefined` (the unbounded path).
  */
 export declare function resolveNodeBudgetWithSource(gs: GraphRunState, nodeId: string, subAgentTokenBudget: number | null): {

package/node_modules/@comis/daemon/dist/graph/graph-node-budget.js

@@ -1,26 +1,26 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * Per-node token-budget accounting for the graph coordinator (BUDGET-02/03).
+ * Per-node token-budget accounting for the graph coordinator.
  *
  * Two concerns, extracted from graph-node-lifecycle to keep that file within the
  * 800-line cap and to give the budget logic a cohesive, directly-testable home:
  *
  * - {@link resolveNodeBudget} — the effective per-node cap (node.tokenBudget wins;
- *   else the operator default; else the graph-budget inherit-share). D3.
+ *   else the operator default; else the graph-budget inherit-share).
  * - {@link applyNodeBudgetBreach} — records per-node spend, and when the node's run
- *   exceeded its cap, fails the node TERMINALLY (D2, bypassing retry), emits the
- *   counts/ids-only `subagent:budget_exceeded` event (M3: attributed to the node's
+ *   exceeded its cap, fails the node TERMINALLY (bypassing retry), emits the
+ *   counts/ids-only `subagent:budget_exceeded` event (attributed to the node's
  *   CHILD agent), and WARNs with an operator-actionable hint. It NEVER aborts the
  *   whole graph — the cumulative abort (graph-completion.handleBudgetExceeded) is a
- *   separate, later line that runs node-first (D5).
+ *   separate, later line that runs node-first.
  *
- * The no-budget path is byte-identical to today: `resolveNodeBudget` returns
- * undefined, so `applyNodeBudgetBreach` records spend and takes no breach branch.
+ * On the no-budget path `resolveNodeBudget` returns undefined, so
+ * `applyNodeBudgetBreach` records spend and takes no breach branch.
  * @module
  */
 import { systemNowMs } from "@comis/core";
 /**
- * P0-A-OBS: the agent-layer `finishReason` values that mean a run aborted on its
+ * The agent-layer `finishReason` values that mean a run aborted on its
  * TOKEN budget via a BudgetGuard PRE-CHECK — the next LLM call was rejected before
  * the overage, so the recorded spend is <= the per-node cap. These drive a per-node
  * budget breach even when `spend <= nodeBudget` (the post-hoc `spend > cap` gate
@@ -30,12 +30,12 @@ import { systemNowMs } from "@comis/core";
 const NODE_BUDGET_ABORT_REASONS = new Set(["budget_exceeded", "budget_exhausted"]);
 /**
  * Resolve the effective per-node token budget for a node.
- * Precedence (D3):
+ * Precedence:
  *  1. `node.tokenBudget` (the graph author's explicit per-node cap) wins.
  *  2. else the operator default `security.agentToAgent.tokenBudget`
  *     (`subAgentTokenBudget`, when not null).
  *  3. else the inherit-share `floor(graphBudget.maxTokens / total node count)`
- *     ONLY when a graph budget is set. WR-01: clamped to >= 1 — when maxTokens
+ *     ONLY when a graph budget is set. Clamped to >= 1 — when maxTokens
  *     < nodeCount the raw floor is 0, which would brick the node (checkBudget
  *     breaches on the first call; applyNodeBudgetBreach terminal-fails it). A
  *     clamp to 1 yields a tight-but-usable cap, never a silent all-nodes-brick.
@@ -45,10 +45,10 @@ export function resolveNodeBudget(gs, nodeId, subAgentTokenBudget) {
     return resolveNodeBudgetWithSource(gs, nodeId, subAgentTokenBudget).budget;
 }
 /**
- * Resolve the effective per-node budget AND the source that produced it (D3).
+ * Resolve the effective per-node budget AND the source that produced it.
  * Single source of truth for the precedence; {@link resolveNodeBudget} returns
  * just the number, {@link applyNodeBudgetBreach} also reports `source` so the
- * breach event/WARN name the exact resolution knob (IN-02). `source` is
+ * breach event/WARN name the exact resolution knob. `source` is
  * `undefined` only when `budget` is `undefined` (the unbounded path).
  */
 export function resolveNodeBudgetWithSource(gs, nodeId, subAgentTokenBudget) {
@@ -59,12 +59,12 @@ export function resolveNodeBudgetWithSource(gs, nodeId, subAgentTokenBudget) {
         return { budget: subAgentTokenBudget, source: "operator-default" };
     const graphMax = gs.graph.graph.budget?.maxTokens;
     const total = gs.graph.graph.nodes.length;
-    // WR-01: Math.max(1, …) — never round the share down to a 0 cap that bricks
+    // Math.max(1, …) — never round the share down to a 0 cap that bricks
     // every node when the graph budget is smaller than the node count.
     if (graphMax !== undefined && total > 0) {
         return { budget: Math.max(1, Math.floor(graphMax / total)), source: "inherit-share" };
     }
-    return { budget: undefined, source: undefined }; // unbounded — byte-identical to today
+    return { budget: undefined, source: undefined }; // unbounded — no per-node cap
 }
 /**
  * Record per-node spend and, on breach, fail the node terminally + emit the event.
@@ -77,25 +77,25 @@ export function resolveNodeBudgetWithSource(gs, nodeId, subAgentTokenBudget) {
  * abort runs AFTER it. This function never aborts the whole graph.
  */
 export function applyNodeBudgetBreach(deps, config, gs, nodeId, spend, priorSessionKey, finishReason) {
-    // BUDGET-03: always record per-node spend (present even when no budget resolves).
+    // Always record per-node spend (present even when no budget resolves).
     gs.nodeTokenSpend.set(nodeId, spend);
-    // IN-02: resolve the cap AND the knob that produced it so the breach names it.
+    // Resolve the cap AND the knob that produced it so the breach names it.
     const { budget: nodeBudget, source: capSource } = resolveNodeBudgetWithSource(gs, nodeId, config.subAgentTokenBudget);
-    // P0-A-OBS (orchestration-excellence): a per-node-budget-bounded node aborts on
+    // A per-node-budget-bounded node aborts on
     // its budget TWO ways — (1) POST-HOC, the graph sees spend > nodeBudget; (2)
     // PRE-CHECK, the agent's BudgetGuard rejected the NEXT LLM call BEFORE the
     // overage (so spend <= nodeBudget) and the run ended with a budget finishReason.
     // BOTH are per-node breaches and must terminal-fail the node + emit
-    // subagent:budget_exceeded — pre-fix the pre-check path was invisible (no event,
-    // empty node error, tokensUsed 0). A budget finishReason with NO per-node cap is
+    // subagent:budget_exceeded — without handling it here the pre-check path is
+    // invisible (no event, empty node error, tokensUsed 0). A budget finishReason with NO per-node cap is
     // a per-ROOT abort owned by handleBudgetExceeded, NOT a per-node breach.
     const postHocOverage = nodeBudget !== undefined && spend > nodeBudget;
     const preCheckAbort = NODE_BUDGET_ABORT_REASONS.has(finishReason ?? "");
     if (nodeBudget === undefined || capSource === undefined || (!postHocOverage && !preCheckAbort) || gs.stateMachine.isTerminal()) {
         return { breached: false };
     }
-    // Terminal-fail the node (D2): a retry would only re-burn the budget. ORCH-OBS:
-    // name the cap SOURCE in the error too — the node error is the only surface
+    // Terminal-fail the node: a retry would only re-burn the budget.
+    // Name the cap SOURCE in the error too — the node error is the only surface
     // graph.status + the IncidentReport failure list see (the WARN/event ride other
     // paths), so an operator drilling a failed node learns WHICH knob bound it. The
     // pre-check path names the finishReason so the abort cause is unambiguous.
@@ -106,7 +106,7 @@ export function applyNodeBudgetBreach(deps, config, gs, nodeId, spend, priorSess
     if (!failRes.ok) {
         deps.logger?.warn({ graphId: gs.graphId, nodeId, error: failRes.error, hint: "Node may have been concurrently updated", errorKind: "internal" }, "Budget-fail node transition failed");
     }
-    // M3: attribute the breach to the node's CHILD agent (node.agentId ?? default),
+    // Attribute the breach to the node's CHILD agent (node.agentId ?? default),
     // NOT gs.callerAgentId (the parent) — mirrors the spawnNode attribution.
     const node = gs.graph.graph.nodes.find((n) => n.nodeId === nodeId);
     deps.eventBus.emit("subagent:budget_exceeded", {
@@ -115,10 +115,10 @@ export function applyNodeBudgetBreach(deps, config, gs, nodeId, spend, priorSess
         agentId: node?.agentId ?? deps.defaultAgentId,
         tokenBudget: nodeBudget,
         tokensUsed: spend,
-        capSource, // IN-02: which knob bound the node (node / operator-default / inherit-share)
+        capSource, // which knob bound the node (node / operator-default / inherit-share)
         timestamp: systemNowMs(),
     });
-    // IN-02: name the exact knob in the hint so the operator knows WHICH lever to pull.
+    // Name the exact knob in the hint so the operator knows WHICH lever to pull.
     const capHintBySource = {
         "node": "the node's own `tokenBudget`",
         "operator-default": "the operator default `security.agentToAgent.tokenBudget`",

package/node_modules/@comis/daemon/dist/graph/graph-node-lifecycle.js

@@ -234,7 +234,7 @@ export function spawnNode(state, deps, config, gs, nodeId, callbacks) {
     const reuseSessionKeyOnRetry = nodeStateForRetry?.priorSessionKey;
     // Regular node spawn wrapped in gatedSpawn for global concurrency
     gatedSpawn(state, deps, config, gs, nodeId, () => {
-        // BUDGET-01/02 (D3): per-node token cap → the child's BudgetGuard per-execution
+        // Per-node token cap → the child's BudgetGuard per-execution
         // cap. Resolved ONCE here so the spawn arg + the graph:node_spawned obs event agree.
         const nodeTokenBudget = resolveNodeBudget(gs, nodeId, config.subAgentTokenBudget);
         const runId = deps.subAgentRunner.spawn({
@@ -242,12 +242,12 @@ export function spawnNode(state, deps, config, gs, nodeId, callbacks) {
             agentId: node.agentId ?? deps.defaultAgentId,
             model: node.model,
             max_steps: node.maxSteps,
-            // BUDGET-01/02 (D3): per-node token cap → the child's BudgetGuard per-execution cap (mid-run hard stop). Pairs with the post-hoc node-fail in handleSubAgentCompleted.
+            // Per-node token cap → the child's BudgetGuard per-execution cap (mid-run hard stop). Pairs with the post-hoc node-fail in handleSubAgentCompleted.
             tokenBudget: nodeTokenBudget,
             callerSessionKey: gs.callerSessionKey,
             callerAgentId: gs.callerAgentId,
             callerType: "graph",
-            ...(gs.rootRunId !== undefined ? { rootRunId: gs.rootRunId } : {}), // Phase 213 CR-01: nodes share the graph's tree root (killByRootRun reach)
+            ...(gs.rootRunId !== undefined ? { rootRunId: gs.rootRunId } : {}), // nodes share the graph's tree root (killByRootRun reach)
             graphSharedDir: gs.sharedDir,
             graphTraceId: gs.graphTraceId,
             graphId: gs.graphId,
@@ -274,7 +274,7 @@ export function spawnNode(state, deps, config, gs, nodeId, callbacks) {
                 status: "running",
                 timestamp: systemNowMs(),
             });
-            // Finding D (TREE-01): emit the spawn-tree leaf producer for this graph node.
+            // Emit the spawn-tree leaf producer for this graph node.
             // A graph node spawns in-process and never crosses the socket chokepoint that
             // emits capability:audited, so without this `comis explain` shows only the
             // root. Content-free: ids + child agentId + rootRunId + the per-node cap.
@@ -491,10 +491,10 @@ export function handleSubAgentCompleted(state, deps, config, gs, event, callback
         }
         catch { /* best-effort, don't block graph progress */ }
     }
-    // 5d. Per-node spend + node-first breach (BUDGET-02/03; D5 — BEFORE the step-6
+    // 5d. Per-node spend + node-first breach — BEFORE the step-6
     // state transition so a breaching SUCCESSFUL run ends `failed` not `completed`,
-    // and BEFORE the cumulative 6.6 check). Records nodeTokenSpend always (IN-01).
-    // P0-A-OBS: pass the agent-layer finishReason so a per-node budget PRE-CHECK
+    // and BEFORE the cumulative 6.6 check. Records nodeTokenSpend always.
+    // Pass the agent-layer finishReason so a per-node budget PRE-CHECK
     // abort (BudgetGuard rejected the next call before the overage → spend <= cap,
     // finishReason "budget_exceeded") still terminal-fails the node + emits
     // subagent:budget_exceeded — not just the post-hoc spend > cap overage.
@@ -562,7 +562,7 @@ export function handleSubAgentCompleted(state, deps, config, gs, event, callback
             emitSkipsAndSpawnReady(deps, gs, result.value, callbacks.spawnReadyNodes);
         }
     }
-    // 6.5. Budget accumulation (graph-wide) + COST-02 per-node corrected-$ ledger:
+    // 6.5. Budget accumulation (graph-wide) + per-node corrected-$ ledger:
     // event.cost is the corrected $ feeding cumulativeCost; sum it per nodeId too
     // (present-only = no dead write; accumulate = re-emits compose, like nodeTokenSpend).
     gs.cumulativeTokens += event.tokensUsed ?? 0;
@@ -589,12 +589,12 @@ export function handleSubAgentCompleted(state, deps, config, gs, event, callback
             nodeId,
             status: nodeCompleted ? "completed" : "failed",
             durationMs: finalNodeState?.startedAt ? systemNowMs() - finalNodeState.startedAt : undefined,
-            // P0-A-OBS: prefer the node STATE error (markNodeFailed's authoritative
+            // Prefer the node STATE error (markNodeFailed's authoritative
             // reason — e.g. the budget-breach attribution) over the raw run.error, which
             // is empty for an agent-layer budget pre-check abort.
             error: nodeCompleted ? undefined : (finalNodeState?.error || run?.error || "Unknown error"),
-            // BUDGET-03: per-node spend on the transition event (additive; undefined when
-            // the completion omits them — byte-identical shape otherwise).
+            // Per-node spend on the transition event (additive; undefined when
+            // the completion omits them — the event shape is unchanged otherwise).
             tokensUsed: event.tokensUsed,
             cost: event.cost,
             timestamp: systemNowMs(),

package/node_modules/@comis/daemon/dist/graph/graph-state-machine.d.ts

@@ -52,7 +52,7 @@ export interface GraphStateMachine {
      *  letting Anthropic cache amortize across retries.
      *  `options.terminal: true` forces a NON-RETRYABLE failure: the retry branch is
      *  skipped even when retries remain. Used for per-node token-budget breaches —
-     *  a retry would only re-burn the budget (BUDGET-02, D2). */
+     *  a retry would only re-burn the budget. */
     markNodeFailed(nodeId: string, error: string, priorSessionKey?: string, options?: {
         terminal?: boolean;
     }): Result<FailureResult, string>;

package/node_modules/@comis/daemon/dist/graph/graph-timeout-floor.d.ts

@@ -1,5 +1,5 @@
 /**
- * Graph-timeout floor (v2.19, OR/timeout fix).
+ * Graph-timeout floor.
  *
  * A weak model routinely sets the graph-level `timeoutMs` too low for the work
  * it just decomposed — observed live: a 6-node NVDA pipeline (4 analysts →

package/node_modules/@comis/daemon/dist/graph/graph-timeout-floor.js

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * Graph-timeout floor (v2.19, OR/timeout fix).
+ * Graph-timeout floor.
  *
  * A weak model routinely sets the graph-level `timeoutMs` too low for the work
  * it just decomposed — observed live: a 6-node NVDA pipeline (4 analysts →

package/node_modules/@comis/daemon/dist/graph/template-interpolation.d.ts

@@ -70,6 +70,6 @@ export declare function buildContextEnvelope(params: {
     failedUpstream?: string[];
     /** Upstream node IDs that were skipped (computed by caller from state machine). */
     skippedUpstream?: string[];
-    /** Resolved conversation language (DET-02 tag); emits a verbatim-preserving Language section when non-en. */
+    /** Resolved conversation language; emits a verbatim-preserving Language section when non-en. */
     language?: string;
 }): string;

package/node_modules/@comis/daemon/dist/graph/template-interpolation.js

@@ -79,7 +79,7 @@ export function interpolateTaskText(taskText, dependsOn, nodeOutputs, maxResultL
             const suffix = sharedDir
                 ? `... [truncated -- full output: ${sharedDir}/${nodeId}-output.md]`
                 : "... [truncated]";
-            // SAFE-01: snap the content-length cut off a split surrogate pair / orphaned
+            // Snap the content-length cut off a split surrogate pair / orphaned
             // combining run so the injected upstream output is mojibake-free.
             replacement = rawOutput.slice(0, adjustSliceBoundary(rawOutput, maxResultLength)) + suffix;
         }
@@ -99,7 +99,7 @@ export function interpolateTaskText(taskText, dependsOn, nodeOutputs, maxResultL
     matches.sort((a, b) => b.start - a.start);
     let result = taskText;
     for (const m of matches) {
-        // SAFE-01 EXCLUDED: this splices on regex MATCH indices of the ASCII
+        // No boundary snap here: this splices on regex MATCH indices of the ASCII
         // `{{nodeId.result}}` template pattern — not a content-length cut. Snapping
         // these boundaries would corrupt the splice (m.start/m.end are pattern edges).
         result = result.slice(0, m.start) + m.replacement + result.slice(m.end);
@@ -171,7 +171,7 @@ export function buildContextEnvelope(params) {
                 const suffix = sharedDir
                     ? `... [truncated -- full output: ${sharedDir}/${depId}-output.md]`
                     : "... [truncated]";
-                // SAFE-01: snap the content-length cut off a split surrogate pair / orphaned
+                // Snap the content-length cut off a split surrogate pair / orphaned
                 // combining run so the upstream-output section is mojibake-free.
                 lines.push(output.slice(0, adjustSliceBoundary(output, effectiveMaxLen)) + suffix);
             }
@@ -201,9 +201,9 @@ export function buildContextEnvelope(params) {
         lines.push(`All nodes in this pipeline share this folder.`);
         lines.push(`NOTE: Upstream nodes may have written detailed reports here that contain more information than the condensed outputs above. Check this folder for additional context.`);
     }
-    // Language section (GEN-03): emit a verbatim-preserving directive when the conversation
-    // language is non-en. SAME sentence text as the 181-04 sub-agent role section (I7 single
-    // source). en/absent pushes nothing → byte-identical envelope (I1).
+    // Language section: emit a verbatim-preserving directive when the conversation
+    // language is non-en. Uses the SAME sentence text as the sub-agent role section
+    // (a single source of truth for the wording). en/absent pushes nothing so the envelope is unchanged.
     if (language && language !== "en") {
         lines.push("");
         lines.push("## Language");

package/node_modules/@comis/daemon/dist/index.d.ts

@@ -29,5 +29,7 @@ export type { StartupInvariantsDeps, StartupInvariants } from "./wiring/setup-st
 export { assembleIncidentReportFromSources } from "./api/obs-handlers/obs-explain.js";
 export { makeRealReader } from "./api/obs-handlers/obs-explain-readers.js";
 export type { IncidentSourceReader } from "./api/obs-handlers/obs-explain-readers.js";
+export { resolveSessionFilePath } from "./api/obs-handlers/obs-explain-readers.js";
 export { assembleFleetHealthReport } from "./api/obs-handlers/fleet-health.js";
 export { DENYLISTED_RPC_METHODS } from "./wiring/setup-capability-endpoint.js";
+export { CAPABILITY_ACTION_CLASS } from "./api/shared/emit-capability-audit.js";

package/node_modules/@comis/daemon/dist/index.js

@@ -71,7 +71,7 @@ export { _resetSigusr1Timer, _resetMutationFence, } from "./api/shared/persist-t
 // _resetSigusr1Timer / _resetMutationFence pattern at persist-to-config.ts.
 // Consumer: test/integration/mcp-config-refresh.test.ts.
 export { _resetConfigMutatedCoalescer } from "./api/mcp-config-mutated-coalescer.js";
-// Phase 216 Plan 08 (MED-6) test seam: the exactly-once chaos test
+// Test seam for the exactly-once chaos test
 // (test/integration/durable-resume-e2e.test.ts) arms a crash-injection hook in
 // the REAL wrapOutwardSend so a live autonomy-originated send crashes in the
 // invariant-#12 window (between markUnknown and commit), leaving a genuine
@@ -88,8 +88,8 @@ export { __setOutwardSendCrashHookForTest, OUTWARD_SEND_CRASH_SENTINEL, } from "
 export { applyBundleInstall } from "./skills/bundle-install-helper.js";
 export { setupSkillBundles, buildSkillRegistriesForBundles } from "./wiring/setup-skill-bundles.js";
 // Resolve-seam learned-skill promote/demote loop body + the in-process
-// decay-aware trend tracker, surfaced through the daemon barrel so the Phase-222
-// MODEL-04 source-agnostic characterization
+// decay-aware trend tracker, surfaced through the daemon barrel so the
+// source-agnostic characterization
 // (test/integration/mental-model-readonly-lifecycle.test.ts) can drive the REAL
 // transition path — a hand-authored (no-synthesis) mental_models doc promotes via
 // promoteByName EXACTLY as a synthesized skill — instead of a store-only fallback.
@@ -118,37 +118,50 @@ export { createTracingLogger } from "./observability/trace-logger.js";
 // Consumer: test/integration/incident-replay-2026-05-24.test.ts
 export { emitStartupInvariants } from "./wiring/setup-startup-invariants.js";
 // Obs-explain assembler + reader DI seam — re-exported so the RE-PROVE
-// scenario (test/live) can call the FROZEN Phase-153 assembler over a fixture
+// scenario (test/live) can call the FROZEN assembler over a fixture
 // reader without a deep daemon-internal dist path. Read-only; the admin gate
 // stays on bindObsExplainHandlers (obs-explain.ts:188) — this exports ONLY the
-// gate-free assembler the X3 tests + the obs_explain MCP tool already call with
+// gate-free assembler the live-scenario tests + the obs_explain MCP tool already call with
 // no _trustLevel, NEVER the admin-gated handler.
 // Consumer: test/live/scenarios/prove/diagnosis-reprove.test.ts
 export { assembleIncidentReportFromSources } from "./api/obs-handlers/obs-explain.js";
 export { makeRealReader } from "./api/obs-handlers/obs-explain-readers.js";
-// Fleet-health assembler RE-PROVE seam (v2.15 — mirrors the v2.14 obs-explain
-// precedent above). Re-exported from the TOP-LEVEL barrel so the keyless fleet
+// Public sessionKey → real session `.jsonl` resolver (pointer discipline).
+// Re-exported so the CLI support-bundle seam resolves a session file the ONE
+// authoritative way — never a hand-built flat `<dataDir>/sessions/<id>` path.
+export { resolveSessionFilePath } from "./api/obs-handlers/obs-explain-readers.js";
+// Fleet-health assembler RE-PROVE seam — mirrors the obs-explain
+// precedent above. Re-exported from the TOP-LEVEL barrel so the keyless fleet
 // RE-PROVE scenario (test/live) can `import { assembleFleetHealthReport } from
 // "@comis/daemon"` — the live config aliases ONLY the top-level @comis/daemon ->
 // daemon/dist/index.js (no obs-handlers subpath alias). The gate-free assembler
-// only; the H1 admin gate stays on bindFleetHealthHandlers (fleet-health.ts).
+// only; the admin gate stays on bindFleetHealthHandlers (fleet-health.ts).
 // Consumer: test/live/scenarios/prove/fleet-reprove.test.ts
 export { assembleFleetHealthReport } from "./api/obs-handlers/fleet-health.js";
-// pi-ai image shim (Phase 183, I1 keystone): `createPiImageAdapter` +
+// pi-ai image shim: `createPiImageAdapter` +
 // `registerComisImageProviders` + `resolveImageApiKey` + the typed cross-plan
 // `ImageGenError` live in `./api/pi-image-adapter.js`. They are daemon-internal
 // — consumed via relative imports (`wiring/setup-image-provider`,
 // `wiring/main-helpers`) — and intentionally NOT on the public barrel until a
 // cross-package consumer exists (public-export-consumers gate). A future-phase
 // transport that genuinely needs one cross-package re-exports it here then.
-// DENYLISTED_RPC_METHODS (Phase 219, CLI-02/03 RE-PROVE seam) — the cap-socket's
+// DENYLISTED_RPC_METHODS (RE-PROVE seam) — the cap-socket's
 // method-precise closed-door set (the `skills_manage`/admin-management methods the
 // endpoint's pre-check throws on BEFORE `validate()`). Re-exported from the
 // top-level barrel so the `comis-agent-same-gate` / `comis-agent-no-admin`
 // arch-tests DERIVE the denylisted-method set from the SAME source the endpoint
 // uses (no hand-maintained literal that drifts). Pure additive `export` — the
 // const + its `SUB_AGENT_TOOL_DENYLIST` soundness loop are unchanged; the daemon
-// runtime behavior is byte-identical. @comis/core cannot import this (it would be
+// runtime behavior is unaffected. @comis/core cannot import this (it would be
 // a package cycle), so the cross-check lives in the architecture-suite arch-test.
 // Consumer: test/architecture/comis-agent-same-gate.test.ts + comis-agent-no-admin.test.ts
 export { DENYLISTED_RPC_METHODS } from "./wiring/setup-capability-endpoint.js";
+// CAPABILITY_ACTION_CLASS (RE-PROVE seam) — the closed capability→action-class
+// map (`read`|`mutate`) the durable audit trail's `classification` reads. Typed
+// `Record<AgentCapability,…>`, so a new cap-union member is a compile-visible gap
+// at its definition. Re-exported from the top-level barrel so the
+// tool-invoke-cap-map arch-test PINS a cap's classification against the SAME
+// runtime map the emitter uses (no drifting hand-copied literal). Pure additive
+// `export` — the emitter behavior is unchanged. Consumer:
+// test/architecture/tool-invoke-cap-map.test.ts
+export { CAPABILITY_ACTION_CLASS } from "./api/shared/emit-capability-audit.js";

package/node_modules/@comis/daemon/dist/notification/notification-service.js

@@ -36,9 +36,9 @@ export function createNotificationService(deps) {
     const rateLimiter = createRateLimiter({
         // Resolve the ceiling PER-AGENT from the agent's own notification config
         // (schema-notification `maxPerHour`), falling back to the default. The
-        // limiter is keyed per-agent (tryAcquire(agentId)) but previously baked in
-        // ONLY defaultConfig.maxPerHour, so a configured per-agent ceiling was
-        // silently ignored (built-but-not-wired).
+        // limiter is keyed per-agent (tryAcquire(agentId)), so the ceiling MUST be
+        // resolved per-agent here — baking in only defaultConfig.maxPerHour would
+        // silently ignore a configured per-agent ceiling.
         maxPerHour: (agentId) => (deps.notificationConfigs.get(agentId) ?? deps.defaultConfig).maxPerHour,
         nowMs: deps.nowMs,
     });

package/node_modules/@comis/daemon/dist/notification/rate-limiter.d.ts

@@ -13,8 +13,8 @@ export declare function createRateLimiter(opts: {
     /**
      * The hourly ceiling. A function resolves it PER-AGENT (called on each
      * tryAcquire) so an agent's own `notification.maxPerHour` config takes effect
-     * rather than a single global default — previously the limiter baked in one
-     * number and silently ignored the schema-supported per-agent ceiling.
+     * rather than a single global default — a fixed number would silently ignore
+     * the schema-supported per-agent ceiling.
      */
     maxPerHour: number | ((agentId: string) => number);
     nowMs?: () => number;