comisai 1.0.44 → 1.0.46

package/node_modules/@comis/daemon/dist/wiring/setup-media.js

@@ -26,7 +26,7 @@ import { createTTSProvider, createSTTProvider, createImageGenProvider, createFal
  * `dataDir` is a stable boot value (`container.config.dataDir`) captured once and
  * threaded into the in-process `local` adapter's model-cache root on every
  * re-creation — the per-call wrapper rebuilds the adapter but the cache scope is
- * fixed at boot (Plan 02 LOCAL-01).
+ * fixed at boot.
  */
 export function createSTTProviderFactory(config, secretManager, dataDir) {
     return () => createSTTProvider(config, secretManager, dataDir);
@@ -39,7 +39,7 @@ export function createSTTProviderFactory(config, secretManager, dataDir) {
  * `dataDir` is a stable boot value (`container.config.dataDir`) captured once and
  * threaded into the in-process `local`/`piper` adapter's model-cache root
  * (`<dataDir>/models/tts/`) on every re-creation — mirrors
- * `createSTTProviderFactory` (TTS-02).
+ * `createSTTProviderFactory`.
  */
 export function createTTSProviderFactory(config, secretManager, dataDir) {
     return () => createTTSProvider(config, secretManager, dataDir);
@@ -128,10 +128,10 @@ export async function setupMedia(deps) {
         skillsLogger.debug("Audio converter initialized");
     }
     // 6.6.8.pre4.5. SSRF-guarded fetcher — safe remote media downloads.
-    // MEDIA-INPUT-SSRF (30uc-20260624 UC-05): trust the operator-configured channel apiRoot ORIGINS
+    // Trust the operator-configured channel apiRoot ORIGINS
     // (a self-hosted local Bot API server / the test emulator on loopback) so media file-byte
     // downloads from a custom apiRoot are permitted past the loopback block — host:port-scoped, so
-    // the strict SSRF firewall still gates every OTHER URL (UC-10's 127.0.0.1:4766 stays blocked).
+    // the strict SSRF firewall still gates every OTHER URL (e.g. the daemon's own 127.0.0.1:4766 stays blocked).
     const channelsCfg = (container.config.channels ?? {});
     const trustedFetchOrigins = Object.values(channelsCfg)
         .map((c) => c?.apiRoot)
@@ -149,10 +149,10 @@ export async function setupMedia(deps) {
     skillsLogger.debug({ maxBytes: infraConfig.maxRemoteFetchBytes, trustedFetchOrigins }, "SSRF-guarded fetcher initialized");
     // 6.6.8.pre5. STT provider — keyless-first resolution THEN factory construction.
     //
-    // Phase 193 (RES-05 / STEER-01): when the daemon supplies the audio selector,
+    // When the daemon supplies the audio selector,
     // resolve the provider BEFORE constructing any adapter. An honest-unavailable
     // resolution (`!sel.ok` — e.g. a Codex/OAuth-only main with no audio key, or
-    // STT `auto` before the local engine lands in Phase 194) constructs NO adapter:
+    // STT `auto` before the local engine is available) constructs NO adapter:
     // `transcriber` stays undefined, the honest-unavailable is logged once, and the
     // downstream inbound path skip-don't-throws (audio-preflight returns
     // {transcribed:false} — the message still reaches the agent). This replaces the
@@ -169,31 +169,31 @@ export async function setupMedia(deps) {
             step: "stt_unavailable",
         }, "STT unavailable — keyless-first resolution (no adapter constructed)");
     }
-    // The construction-gating predicate, computed in exactly ONE place (WR-03):
+    // The construction-gating predicate, computed in exactly ONE place:
     // blocked ONLY when the selector ran and returned honest-unavailable (`ok ===
     // false`) — that gates construction OFF (no empty-bearer adapter). An undefined
-    // selector (test harnesses / pre-193 callers) is NOT blocked (construct
+    // selector (test harnesses / callers without a selector) is NOT blocked (construct
     // directly). Keeping the gate and the logged-branch derived from this single
     // discriminant prevents a future edit from making them diverge.
     // The scoped model-cache root for the in-process `local` adapters. Resolved
     // ONCE at function scope from `container.config.dataDir` (NEVER process.env) so
-    // BOTH the STT (`<dataDir>/models/whisper/`, Plan 194-02 LOCAL-01) and the TTS
-    // (`<dataDir>/models/tts/`, TTS-02) construct/factory sites thread the identical
+    // BOTH the STT (`<dataDir>/models/whisper/`) and the TTS
+    // (`<dataDir>/models/tts/`) construct/factory sites thread the identical
     // value in lockstep; the `safePath(homedir, ".comis")` fallback mirrors
     // daemon.ts when the config field is unset.
     const dataDir = container.config.dataDir ?? safePath(os.homedir(), ".comis");
     const sttBlocked = sttSel?.ok === false;
-    // Construct only when NOT blocked by the resolver. For 193 an approved
+    // Construct only when NOT blocked by the resolver. An approved
     // `sttSel.provider` is openai/groq/deepgram (keyed cases the factory handles) —
-    // `local` resolves only when localEngineAvailable() is true (false in 193, the
-    // Phase 194 seam), so the factory never sees `local` yet; `edge` is TTS-only.
+    // `local` resolves only when localEngineAvailable() is true, so the factory
+    // never sees `local` yet; `edge` is TTS-only.
     if (!sttBlocked) {
-        // WR-01/WR-02: thread the RESOLVED provider (+ its model) into construction
+        // Thread the RESOLVED provider (+ its model) into construction
         // so the factory sees the provider the resolver actually approved (e.g. a
-        // CRED-01 follow-main `auto`→openai), NOT the raw config `provider:"auto"`
+        // credential follow-main `auto`→openai), NOT the raw config `provider:"auto"`
         // which would hit the factory `default` → err. Mirrors the fallback loop
-        // below. Only override when a selector ran (`sttSel?.ok`); preserve pre-193
-        // behavior (construct straight from config) when no selector was supplied.
+        // below. Only override when a selector ran (`sttSel?.ok`); construct straight
+        // from config when no selector was supplied.
         const sttConfig = sttSel?.ok
             ? {
                 ...mediaConfig.transcription,
@@ -261,7 +261,7 @@ export async function setupMedia(deps) {
     }
     // 6.6.8. TTS adapter — keyless-first resolution THEN factory construction.
     //
-    // Phase 193 (RES-02 / RES-05): when the daemon supplies the audio selector,
+    // When the daemon supplies the audio selector,
     // resolve TTS BEFORE constructing any adapter. `auto`/default resolves to the
     // keyless Edge adapter (no key); an explicit keyed provider with a present key
     // resolves explicit; honest-unavailable (`!sel.ok`) constructs NO adapter +
@@ -272,22 +272,22 @@ export async function setupMedia(deps) {
         skillsLogger.warn({
             err: ttsSel.errorKind,
             // STT_ERR_TO_LOG is intentionally shared: TTS reuses the SttErrorKind
-            // vocabulary + its log bridge (voice-error.ts, design Assumption A3) —
+            // vocabulary + its log bridge (voice-error.ts) —
             // `TtsSelection.errorKind` is typed `SttErrorKind`. The STT-named symbol
-            // here is correct, not a copy-paste (IN-01).
+            // here is correct, not a copy-paste.
             errorKind: STT_ERR_TO_LOG[ttsSel.errorKind],
             hint: ttsSel.hint,
             step: "tts_unavailable",
         }, "TTS unavailable — keyless-first resolution (no adapter constructed)");
     }
-    // Single discriminant for the construction gate (WR-03) — see the STT note above.
+    // Single discriminant for the construction gate — see the STT note above.
     const ttsBlocked = ttsSel?.ok === false;
     if (!ttsBlocked) {
-        // WR-01: thread the RESOLVED provider into construction (mirrors STT). Today
+        // Thread the RESOLVED provider into construction (mirrors STT). Today
         // `auto`→edge works because the default config already carries
         // `provider:"edge"`, but an operator who disables edge and relies on
         // follow-main would otherwise hit the identical `default`→err trap. Only
-        // override when a selector ran; preserve pre-193 behavior otherwise.
+        // override when a selector ran; construct straight from config otherwise.
         const ttsConfig = ttsSel?.ok
             ? { ...mediaConfig.tts, provider: ttsSel.provider }
             : mediaConfig.tts;
@@ -420,7 +420,7 @@ export async function setupMedia(deps) {
         });
         skillsLogger.debug({ supportedMimes: fileExtractor.supportedMimes.length, autoEnabled: docExtractionConfig.enabled }, "File extractor initialized");
     }
-    // OBS-03 (196): surface the boot-resolved STT/TTS selections so the daemon RPC
+    // Surface the boot-resolved STT/TTS selections so the daemon RPC
     // handlers thread `source`/`keyless`/`provider` + the collected `onSkip` reasons
     // onto the `media.stt.*`/`media.tts.*` trajectory (no re-derivation — the SAME
     // SttSelection/TtsSelection the adapter construction above used). Present only
@@ -429,7 +429,7 @@ export async function setupMedia(deps) {
     // config-derived provider + keyless).
     const voiceSelection = {};
     if (sttSel?.ok) {
-        // Optional-call `sttSkips` — a selector built before the 196 skip-collection
+        // Optional-call `sttSkips` — a selector without the skip-collection method
         // (or a partial test mock) may not expose it; an absent collector → no onSkip.
         const skips = deps.audioSelector?.sttSkips?.() ?? [];
         voiceSelection.stt = {

package/node_modules/@comis/daemon/dist/wiring/setup-memory-cost-notice.d.ts

@@ -1,8 +1,8 @@
 /**
- * First-run cost-disclosure notice (v1 opt-out posture — increment 1).
+ * First-run cost-disclosure notice (opt-out posture).
  *
- * On daemon startup, when the master cost-feature kill switch (`memory.enabled`,
- * renamed from `memory.costFeatures.enabled` in Phase 226) is ON (the default)
+ * On daemon startup, when the master cost-feature kill switch (`memory.enabled`)
+ * is ON (the default)
  * AND at least one LLM cost-bearing memory feature is actually active for some
  * agent, emit ONE prominent WARN that:
  *   - names the active cost features,
@@ -15,14 +15,10 @@
  * (today's default bare config), it emits NOTHING. It never logs a secret/key —
  * only feature names and a count.
  *
- * Scope of "cost-bearing" mirrors the kill switch exactly: the surviving crons
+ * Scope of "cost-bearing" mirrors the kill switch exactly: the cost-bearing crons
  * (memoryReview, memoryUsefulnessJudge) and the query-time dialectic tool
- * (`memory_ask`). (memoryOnlineTuning — the bandit cron — was deleted in Phase 224;
- * memoryConsolidation / memoryReasoning / memoryUserRepresentation were deleted in
- * Phase 225-05 — their work folded into the one learningSkills-gated reflection cron.)
- * The $0 keyless memoryLifecycle sweep is NOT a cost feature here (lifecycle is
- * keyless), so it does not trigger the notice. (The privacy-gated socialModeling
- * cron was DELETED in Phase 226 SIMPLIFY-03 with the rest of that subsystem.)
+ * (`memory_ask`). The $0 keyless memoryLifecycle sweep is NOT a cost feature here
+ * (lifecycle is keyless), so it does not trigger the notice.
  *
  * @module
  */
@@ -43,8 +39,7 @@ interface CostFeatureAgentSlice {
 export interface MemoryCostFeatureNoticeDeps {
     /** All per-agent configs (the same `container.config.agents` map). */
     agents: Record<string, CostFeatureAgentSlice>;
-    /** The master kill switch (`memory.enabled`, renamed from `memory.costFeatures.enabled`
-     *  in Phase 226). When false ⇒ no notice. */
+    /** The master kill switch (`memory.enabled`). When false ⇒ no notice. */
     costFeaturesEnabled: boolean;
     /** Counts/names-only structural logger — never a secret/key. */
     logger: ComisLogger;

package/node_modules/@comis/daemon/dist/wiring/setup-memory-cost-notice.js

@@ -1,9 +1,9 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * First-run cost-disclosure notice (v1 opt-out posture — increment 1).
+ * First-run cost-disclosure notice (opt-out posture).
  *
- * On daemon startup, when the master cost-feature kill switch (`memory.enabled`,
- * renamed from `memory.costFeatures.enabled` in Phase 226) is ON (the default)
+ * On daemon startup, when the master cost-feature kill switch (`memory.enabled`)
+ * is ON (the default)
  * AND at least one LLM cost-bearing memory feature is actually active for some
  * agent, emit ONE prominent WARN that:
  *   - names the active cost features,
@@ -16,14 +16,10 @@
  * (today's default bare config), it emits NOTHING. It never logs a secret/key —
  * only feature names and a count.
  *
- * Scope of "cost-bearing" mirrors the kill switch exactly: the surviving crons
+ * Scope of "cost-bearing" mirrors the kill switch exactly: the cost-bearing crons
  * (memoryReview, memoryUsefulnessJudge) and the query-time dialectic tool
- * (`memory_ask`). (memoryOnlineTuning — the bandit cron — was deleted in Phase 224;
- * memoryConsolidation / memoryReasoning / memoryUserRepresentation were deleted in
- * Phase 225-05 — their work folded into the one learningSkills-gated reflection cron.)
- * The $0 keyless memoryLifecycle sweep is NOT a cost feature here (lifecycle is
- * keyless), so it does not trigger the notice. (The privacy-gated socialModeling
- * cron was DELETED in Phase 226 SIMPLIFY-03 with the rest of that subsystem.)
+ * (`memory_ask`). The $0 keyless memoryLifecycle sweep is NOT a cost feature here
+ * (lifecycle is keyless), so it does not trigger the notice.
  *
  * @module
  */

package/node_modules/@comis/daemon/dist/wiring/setup-memory.d.ts

@@ -20,7 +20,7 @@ export interface MemoryResult {
     db: ReturnType<SqliteMemoryAdapter["getDb"]>;
     /** Session persistence store. */
     sessionStore: ReturnType<typeof createSessionStore>;
-    /** LCD lossless context store (Phase 127); the live append-on-turn write-path is wired in Phase 128. */
+    /** LCD lossless context store; the live append-on-turn write-path is wired elsewhere. */
     lcdStore: ReturnType<typeof createLcdStore>;
     provenanceStore: ReturnType<typeof buildProvenanceReadStore>;
     contextBrowse: ReturnType<typeof createLcdBrowseStore>;
@@ -108,12 +108,12 @@ export interface MemoryResult {
      *  the shared `db` (no model/IO cost). Feedback loop dormant until `rag.feedback.enabled` (default OFF);
      *  the write-back subscriber is wired separately. */
     usefulnessStore: import("@comis/core").MemoryUsefulnessStore;
-    /** Outcome-signal store (Verified Learning WS1). SOLE `OutcomeSignalPort` adapter; shared `db`,
-     *  no model/IO cost; gated at observe/resolve (agent never receives it — SEC-01). Returned so the
-     *  daemon can `prune(retentionDays)` at startup (OUTCOME-07); the observe/resolve subscriber is wired here. */
+    /** Outcome-signal store. SOLE `OutcomeSignalPort` adapter; shared `db`,
+     *  no model/IO cost; gated at observe/resolve (agent never receives it — the agent↛memory cut). Returned so the
+     *  daemon can `prune(retentionDays)` at startup; the observe/resolve subscriber is wired here. */
     outcomeStore: import("@comis/core").OutcomeSignalPort;
     learnedSkillStore: import("@comis/core").MentalModelStorePort;
-    /** REACT-02 (Phase 199): outbound-message → trajectory capture callback, threaded into the delivery drain. `undefined` when learning-outcome is off for all agents (byte-identity: zero extra work). `participantId` (FLAG-2) is the conversation participant (inbound sender) so a reaction from an unmapped group bystander is inert. */
+    /** Outbound-message → trajectory capture callback, threaded into the delivery drain. `undefined` when learning-outcome is off for all agents (byte-identity: zero extra work). `participantId` is the conversation participant (inbound sender) so a reaction from an unmapped group bystander is inert. */
     recordOutboundMessage?: (messageId: string, scope: {
         traceId: string;
         tenantId: string;
@@ -121,7 +121,7 @@ export interface MemoryResult {
         sessionId: string;
         participantId?: string;
     }) => void;
-    /** WR-01 (Phase 199): tear down the reaction/session trajectory maps + the dedicated reaction rate limiter (cancels their unref'd TTL timers). Invoked from the daemon shutdown path. */
+    /** Tear down the reaction/session trajectory maps + the dedicated reaction rate limiter (cancels their unref'd TTL timers). Invoked from the daemon shutdown path. */
     destroyReactionWiring: () => void;
     /** Memory-lifecycle sweep store. SOLE `MemoryLifecyclePort` adapter; shared `db`, no model/IO cost. DORMANT
      *  (0 rows swept even when enabled); the KEYLESS __MEMORY_LIFECYCLE__ cron registers only when `memoryLifecycle.enabled`. */
@@ -158,8 +158,8 @@ export declare function setupMemory(deps: {
     memoryLogger: ComisLogger;
     /** Wall-clock + monotonic time reads. */
     clock: import("@comis/core").ClockPort;
-    /** setTimeout scheduling (TimerPort) — the reaction trajectory map + rate limiter need it (REACT-02/03). */
+    /** setTimeout scheduling (TimerPort) — the reaction trajectory map + rate limiter need it. */
     timers: import("@comis/core").TimerPort;
-    /** WR-01: shared per-agent learned-skill SURFACE registry — forwarded into setupLearningOutcomeWiring so the promote/demote loop can re-refresh an agent's surface (next-session pickup). */
+    /** Shared per-agent learned-skill SURFACE registry — forwarded into setupLearningOutcomeWiring so the promote/demote loop can re-refresh an agent's surface (next-session pickup). */
     learnedSkillSurfaceRegistry?: import("./setup-agents/learned-skill-surface-registry.js").LearnedSkillSurfaceRegistry;
 }): Promise<MemoryResult>;

package/node_modules/@comis/daemon/dist/wiring/setup-memory.js

@@ -119,13 +119,13 @@ export async function setupMemory(deps) {
     // through setupAgents -> createPiExecutor -> setupContextEngine so
     // `getSummarizerDeps` wraps the leaf seam with `gate(tenantId, inner)`; ONE
     // instance partitions internally by tenantId so it bounds AGGREGATE per-tenant
-    // summarizer spend across all of a tenant's sessions/agents (Pitfall 1). The
+    // summarizer spend across all of a tenant's sessions/agents. The
     // breaker/spend KNOBS are the daemon-level ContextEngine defaults
     // (failureThreshold 5; 500k tok/h, 5M tok/day) — a per-tenant aggregate cannot
     // coherently read a single agent's per-agent override since a tenant's sessions
     // span many agents, so the schema default is the daemon-global source. Token
-    // estimates reuse the agent `estimateMessageTokens` heuristic (RESEARCH
-    // "Don't Hand-Roll the estimator").
+    // estimates reuse the agent `estimateMessageTokens` heuristic rather than
+    // hand-rolling a separate estimator.
     const ceDefaults = ContextEngineConfigSchema.parse({});
     const summarizerSpendBreaker = createSummarizerSpendBreaker({
         breakerConfig: ceDefaults.summarizerBreaker,
@@ -240,7 +240,7 @@ export async function setupMemory(deps) {
     // Adapter uses embedding port only at query time (search()), not during construction.
     // Created BEFORE cache wiring because createSqliteEmbeddingCache needs the db handle.
     const effectiveDimensions = embeddingPort ? embeddingPort.dimensions : memoryConfig.recall.embeddingDimensions;
-    // Phase 226: the recall keepers nest under memory.recall — override the nested dimension.
+    // The recall keepers nest under memory.recall — override the nested dimension.
     const adjustedMemoryConfig = { ...memoryConfig, recall: { ...memoryConfig.recall, embeddingDimensions: effectiveDimensions } };
     const memoryAdapter = new SqliteMemoryAdapter(adjustedMemoryConfig, embeddingPort, memoryLogger);
     const db = memoryAdapter.getDb();
@@ -290,10 +290,6 @@ export async function setupMemory(deps) {
     // scoped read never runs by default. Composition-root join — the agent receives the port TYPE
     // only (the agent↛memory cut). Threaded into the recall read path (setup-agents-*).
     const embeddingStore = createSqliteMemoryEmbeddingStore({ db, logger: memoryLogger });
-    // (6.5.2b''''''. The directional relationship store construction was DELETED in Phase 226-04
-    //  with the rest of the social-modeling subsystem — the createSqliteRelationshipStore adapter,
-    //  the `relationship` table, the offline `__SOCIAL_MODELING__` builder cron, the prompt injection
-    //  are all gone. No alias, I1.)
     // 6.5.2c. Consolidation store. Built on the SAME `db` handle the memory
     // adapter owns — NOT a second Database — so the observation columns (proof_count /
     // source_ids / consolidated_at / confidence / history) and the memories table share
@@ -315,11 +311,10 @@ export async function setupMemory(deps) {
     // ONLY; the attribution write-back subscriber is wired separately
     // (it depends on a recall-attribution bus event not yet declared at this point).
     const usefulnessStore = createSqliteMemoryUsefulnessStore({ db, logger: memoryLogger });
-    // 6.5.2d-bis. (The tuned-alpha store was DELETED in Phase 224 — the UCB recall bandit is
-    // gone; recall scoring is the fixed config.rag.scoring alphas, no tuned_alpha read/write.)
-    // 6.5.2d-quater. Outcome-signal store (Verified Learning WS1, OUTCOME-01). UNCONDITIONAL on the shared `db` (no model/IO cost; gated at observe/resolve). SOLE OutcomeSignalPort adapter; agent never receives it (SEC-01); only wireLearningOutcome + the startup prune consume it (closed-graph).
+    // 6.5.2d-bis. Recall scoring uses the fixed config.rag.scoring alphas (no tuned-alpha read/write).
+    // 6.5.2d-quater. Outcome-signal store. UNCONDITIONAL on the shared `db` (no model/IO cost; gated at observe/resolve). SOLE OutcomeSignalPort adapter; agent never receives it (the agent↛memory cut); only wireLearningOutcome + the startup prune consume it (closed-graph).
     const outcomeStore = createSqliteOutcomeStore({ db, logger: memoryLogger });
-    // 6.5.2d-quinquies. Learned-skill store (WS2/skills, SKILL-01). UNCONDITIONAL on the shared `db` (DB-CHECK forces trust=learned). SOLE MentalModelStorePort adapter; agent↛memory cut — the daemon injects it into the __REFLECT__ cron. DORMANT until learningSkills.enabled.
+    // 6.5.2d-quinquies. Learned-skill store. UNCONDITIONAL on the shared `db` (DB-CHECK forces trust=learned). SOLE MentalModelStorePort adapter; agent↛memory cut — the daemon injects it into the __REFLECT__ cron. DORMANT until learningSkills.enabled.
     const learnedSkillStore = createSqliteMentalModelStore({ db, logger: memoryLogger });
     // 6.5.2d-ter. Memory-lifecycle sweep store. Built on the SAME shared `db` (NOT a second Database) so the sweep
     // scans the SAME `memories` rows under one (tenant, agent)-scoped FK-enabled connection. Always constructed (no
@@ -350,7 +345,7 @@ export async function setupMemory(deps) {
         feedbackEnabled: () => Object.values(container.config.agents ?? {}).some((a) => a?.rag?.feedback
             ?.enabled === true),
     });
-    // 6.5.2f'. WS1 outcome subscriber + RANK/FORGET reward-at-resolve + OUTCOME-04 LLM-judge fallback (own leaf, byte-identity-gated); lcdStore created here for the judge transcript reader.
+    // 6.5.2f'. Outcome subscriber + reward-at-resolve (reward/failure writes) + LLM-judge fallback (own leaf, byte-identity-gated); lcdStore created here for the judge transcript reader.
     const lcdStore = createLcdStore(db);
     const judge = buildOutcomeJudgeWiring(container, clock, memoryLogger, lcdStore);
     setupLearningOutcomeWiring({
@@ -361,11 +356,11 @@ export async function setupMemory(deps) {
         learnedSkillSurfaceRegistry: deps.learnedSkillSurfaceRegistry,
         outcomeJudge: judge.outcomeJudge, learningOutcomeJudgeEnabled: judge.learningOutcomeJudgeEnabled, readTurnTranscript: judge.readTurnTranscript,
     });
-    // 6.5.2f''. Reaction + correction outcome wiring (Verified Learning WS1, Phase 199 — the corroborating sources) behind the byte-identity gate; bulk lives in the co-located helper.
+    // 6.5.2f''. Reaction + correction outcome wiring (the corroborating sources) behind the byte-identity gate; bulk lives in the co-located helper.
     const reactionWiring = buildReactionWiringDeps({ config: container.config, secretManager: container.secretManager, eventBus: container.eventBus, outcomeStore, logger: memoryLogger }, clock, timers);
     wireLearningReactions(reactionWiring.deps);
     wireLearningCorrection(reactionWiring.deps);
-    const { recordOutboundMessage, destroyReactionWiring } = reactionWiring; // WR-01: destroy* tears down the reaction/session maps + rate-limiter timers at shutdown
+    const { recordOutboundMessage, destroyReactionWiring } = reactionWiring; // destroy* tears down the reaction/session maps + rate-limiter timers at shutdown
     // 6.5.3. Wire caching: L1(L2(provider)) when persistent, L1(provider) otherwise
     let cachedPort;
     let embeddingCacheStats;
@@ -441,7 +436,7 @@ export async function setupMemory(deps) {
         embeddingQueue = createEmbeddingQueue(db, cachedPort);
     }
     const sessionStore = createSessionStore(db); // lcdStore is created earlier (6.5.2d-sexies) for the judge reader
-    const provenanceStore = buildProvenanceReadStore(db); // DIST-03 read side (Phase 173 carry-in); same db handle; threaded to createMemoryRecall's down-weighting pass (built-but-not-wired fix)
+    const provenanceStore = buildProvenanceReadStore(db); // LCD provenance read side; same db handle; threaded to createMemoryRecall's down-weighting pass
     const contextBrowse = createLcdBrowseStore(db); // ContextBrowsePort (context.conversations)
     const memoryApi = createMemoryApi(db, memoryAdapter, sessionStore, memoryConfig);
     memoryLogger.debug({ dbPath: memoryConfig.dbPath, embedding: !!cachedPort }, "Memory services initialized");

package/node_modules/@comis/daemon/dist/wiring/setup-observability.d.ts

@@ -41,18 +41,18 @@ export interface ObservabilityResult {
      */
     disposeActivityStream: () => void;
     /**
-     * The single daemon-wide spend accumulator (Phase 177 — the dollars
+     * The single daemon-wide spend accumulator (the dollars
      * kill-switch enforcement state). CONSTRUCTED here beside the cross-agent
      * cost-tracker subscriber, with the live `recordSpend` subscriber registered
      * on `observability:token_usage`. The per-agent bridge guards hold a REFERENCE
-     * to this SAME instance (Pitfall 4). REHYDRATION happens at the boot
+     * to this SAME instance. REHYDRATION happens at the boot
      * composition root (daemon.ts) via {@link rehydrateSpendFromStore} once
      * `obsStore` exists. `undefined` when `clock`/`config` were not threaded
-     * (e.g. legacy/test call shapes) — the spend path is then inert.
+     * (e.g. test call shapes) — the spend path is then inert.
      */
     spendAccumulator?: SpendAccumulator;
     /**
-     * The OTLP/Prometheus exporter registration handle (Phase 178) — present ONLY
+     * The OTLP/Prometheus exporter registration handle — present ONLY
      * when `observability.otel.enabled || observability.prometheus.enabled` AND the
      * opt-in `@comis/observability-otel` extension loaded successfully. `shutdown()`
      * flushes + closes the OTel providers (and stops the `/metrics` listener); the
@@ -112,14 +112,14 @@ export declare function setupObservability(deps: {
     theme?: ActivityTheme;
     /**
      * The boot {@link ClockPort} (the SAME one threaded elsewhere, e.g.
-     * daemon.ts:958/2544). Injected so the daemon-wide spend accumulator (Phase
-     * 177) is constructed here. Optional — when absent the spend accumulator is
-     * NOT constructed (legacy/test call shapes stay byte-identical).
+     * daemon.ts:958/2544). Injected so the daemon-wide spend accumulator
+     * is constructed here. Optional — when absent the spend accumulator is
+     * NOT constructed (test call shapes stay byte-identical).
      */
     clock?: ClockPort;
     /**
      * The full app config. Read here for `observability.spend.*` (the spend
-     * kill-switch ceilings) AND `observability.{otel,prometheus}` (the Phase 178
+     * kill-switch ceilings) AND `observability.{otel,prometheus}` (the
      * exporter seam below). Optional — when absent (with `clock`) the accumulator
      * is not constructed and the OTel seam is skipped.
      */

package/node_modules/@comis/daemon/dist/wiring/setup-observability.js

@@ -47,7 +47,7 @@ export async function setupObservability(deps) {
             operationType: "interactive",
         });
     });
-    // The single daemon-wide spend accumulator (Phase 177, E2) — the dollars
+    // The single daemon-wide spend accumulator — the dollars
     // kill-switch enforcement-state owner. CONSTRUCTED here beside the cross-agent
     // cost-tracker (the established daemon-wide subscriber seam); everything it
     // needs at construction is `clock` + `config.observability.spend` + `eventBus`.
@@ -55,7 +55,7 @@ export async function setupObservability(deps) {
     // `rehydrateSpendFromStore` because the persisted rolling-spend read lives on
     // `obsStore`, which is not reachable until obsStore is built ~60-90 lines after
     // this call (and only when persistence is enabled). When `clock`/`config` are
-    // absent the accumulator is not constructed (legacy/test call shapes stay
+    // absent the accumulator is not constructed (test call shapes stay
     // byte-identical).
     let spendAccumulator;
     // Defensive at the composition root: only construct when clock + the spend
@@ -87,21 +87,21 @@ export async function setupObservability(deps) {
             acc.recordSpend(scope, payload.cost.total);
         });
     }
-    // Phase 178 — the config-gated OTLP/Prometheus exporter seam (Landmine P1).
+    // The config-gated OTLP/Prometheus exporter seam.
     // The opt-in `@comis/observability-otel` extension is loaded ONLY when
     // `observability.otel.enabled || observability.prometheus.enabled` via a runtime
     // `await import()` (the daemon's documented optional-load pattern —
     // preflight-doctor.ts/better-sqlite3, config-export.ts/yaml). The static surface
     // is type-only (`import type { OtelExporterDeps }`), so core/daemon `build:clean`
-    // succeed with the extension's `dist/` absent (N2). The try/catch is mandatory:
+    // succeed with the extension's `dist/` absent. The try/catch is mandatory:
     // an enabled-but-unavailable/throwing extension WARNs with a hint and DEGRADES
-    // (telemetry off), NEVER crashing boot (the self-DoS guard, T-178-06).
+    // (telemetry off), NEVER crashing boot (the self-DoS guard).
     let otelHandle;
     const otelCfg = deps.config?.observability?.otel;
     const promCfg = deps.config?.observability?.prometheus;
     if ((otelCfg?.enabled === true || promCfg?.enabled === true) && deps.config !== undefined) {
         const observability = deps.config.observability;
-        // MD-01: the `/metrics` pull surface has NO built-in auth (the OTel
+        // The `/metrics` pull surface has NO built-in auth (the OTel
         // PrometheusExporter serves the operational shape — metric names, labels,
         // series counts — unauthenticated; `prometheus.auth:'trusted-operator'` is
         // ADVISORY, realized by the loopback bind + the operator's reverse
@@ -139,17 +139,17 @@ export async function setupObservability(deps) {
             const mod = (await import(extensionSpecifier));
             otelHandle = mod.registerOtelExporter({
                 eventBus,
-                // LOW-1: forward the boot clock ONLY when present (conditional spread) —
+                // Forward the boot clock ONLY when present (conditional spread) —
                 // never `deps.clock as ClockPort` (which passes `undefined as ClockPort`
-                // on the legacy/test call shape, an unsound contract lie). The extension
+                // on a test call shape, an unsound contract lie). The extension
                 // never calls wall-clock APIs, so omitting the key when absent is safe.
                 ...(deps.clock !== undefined ? { clock: deps.clock } : {}),
                 observability,
-                // The 177 accumulator reference (the comis_spend_* gauge source). Omitted
+                // The accumulator reference (the comis_spend_* gauge source). Omitted
                 // when no accumulator was constructed (clock/config absent → the
                 // exactOptionalPropertyTypes-safe conditional spread).
                 ...(spendAccumulator !== undefined ? { spendAccumulator } : {}),
-                // The daemon version label for comis_build_info (CR-01).
+                // The daemon version label for comis_build_info.
                 ...(deps.version !== undefined ? { version: deps.version } : {}),
                 ...(deps.logger !== undefined ? { logger: deps.logger } : {}),
             });
@@ -241,11 +241,11 @@ export async function setupObservability(deps) {
         // the correlation index. The shutdown chain invokes this so pending per-turn
         // bounded queues drain and no placeholder is orphaned across restart.
         disposeActivityStream: () => activityStream.dispose(),
-        // The daemon-wide spend accumulator (Phase 177). Threaded out so the boot
+        // The daemon-wide spend accumulator. Threaded out so the boot
         // root rehydrates it (after obsStore exists) and the per-agent bridge guards
         // hold a reference to the SAME instance.
         spendAccumulator,
-        // The OTLP/Prometheus exporter handle (Phase 178) — undefined unless an
+        // The OTLP/Prometheus exporter handle — undefined unless an
         // enabled extension loaded; the daemon threads otelHandle.shutdown() into the
         // shutdown chain alongside disposeActivityStream.
         otelHandle,

package/node_modules/@comis/daemon/dist/wiring/setup-orchestrate-replay.d.ts

@@ -0,0 +1,112 @@
+import type { DurableRunPort } from "@comis/core";
+import type { ComisLogger } from "@comis/infra";
+import { type OrchestrateReplaySocket } from "./orchestrate-replay-socket.js";
+/** The input the re-spawn seam receives for one deterministic replay. */
+export interface OrchestrateReplayRespawnInput {
+    /** The validated durable root run id being replayed. */
+    readonly rootRunId: string;
+    /** The run's jailed workspace (`<workspacePath>/results/replay.jsonl` lives here). */
+    readonly workspacePath: string;
+    /** The bound replay socket path — the re-spawn's `COMIS_ORCH_SOCKET` target (INV-1). */
+    readonly socketPath: string;
+    /** The ephemeral replay bearer — the re-spawn's `COMIS_CAP_LEASE`. */
+    readonly bearer: string;
+    /**
+     * The child env with `COMIS_ORCH_SOCKET`/`COMIS_CAP_LEASE` already pointed at
+     * the replay socket + bearer (built by {@link buildReplayChildEnv}). The
+     * production seam merges it over the sandbox base before spawning.
+     */
+    readonly childEnv: Record<string, string | undefined>;
+}
+/**
+ * The re-spawn seam: re-run the durable run's PINNED bytes against the replay
+ * socket and return the produced stdout. INJECTED — the sandbox-backed
+ * production closure (loadResumeSpec + runScriptWithOneShotRepair) is assembled
+ * at the composition root; the macOS tests inject a fake. `diverged` is set when
+ * a re-run cap call did not match the next recorded result.
+ */
+export type OrchestrateReplayRespawn = (input: OrchestrateReplayRespawnInput) => Promise<{
+    stdout: string;
+    diverged?: boolean;
+}>;
+/**
+ * The daemon-assembled replay wiring cluster (the pieces that need a daemon
+ * resource + cannot be defaulted): the daemon-wide OutputGuard the ephemeral
+ * bearer registers in, the sandbox-backed re-spawn seam, and (optionally) a
+ * replay-socket factory override. The composition root supplies this; rpc-dispatch
+ * combines it with the durable store + a workspace resolver into the session deps.
+ * OPTIONAL on the dispatch deps ⇒ absent ⇒ `orchestrate.replay` is not registered.
+ */
+export interface OrchestrateReplayWiring {
+    /** The daemon-wide OutputGuard — the ephemeral bearer registers here (Pitfall 6). */
+    readonly outputGuard: {
+        registerSecret(secret: string): void;
+    };
+    /** The sandbox-backed pinned-byte re-spawn (points COMIS_ORCH_SOCKET at the replay socket). */
+    readonly respawn: OrchestrateReplayRespawn;
+    /** Optional replay-socket factory override (defaults to `createOrchestrateReplaySocket`). */
+    readonly createReplaySocket?: (deps: {
+        workspacePath: string;
+        logger?: ComisLogger;
+    }) => OrchestrateReplaySocket;
+}
+/** Everything {@link runOrchestrateReplaySession} needs, with seams for the macOS tests. */
+export interface OrchestrateReplaySessionDeps {
+    /** The durable-run store — `getByRootRun` validates the runId to a real row. */
+    readonly durableRuns: Pick<DurableRunPort, "getByRootRun">;
+    /** Resolve the run's jailed workspace path (the replay socket reads under it). */
+    readonly resolveWorkspace: (rootRunId: string) => string;
+    /** The sandbox-backed pinned-byte re-spawn seam. */
+    readonly respawn: OrchestrateReplayRespawn;
+    /** The daemon-wide OutputGuard the ephemeral bearer registers in (Pitfall 6). */
+    readonly outputGuard: {
+        registerSecret(secret: string): void;
+    };
+    /** Structured logger for the content-free §2.7 instrumentation. */
+    readonly logger: ComisLogger;
+    /** Replay-socket factory (defaults to the plan-05 `createOrchestrateReplaySocket`). */
+    readonly createReplaySocket?: (deps: {
+        workspacePath: string;
+        logger?: ComisLogger;
+    }) => OrchestrateReplaySocket;
+    /** Ephemeral-bearer minter (defaults to a 256-bit random hex). */
+    readonly mintBearer?: () => string;
+    /** Fresh 0600 replay-socket path resolver (defaults to an OS-temp-dir path). */
+    readonly resolveReplaySocketPath?: (rootRunId: string) => string;
+}
+/** A throwaway 256-bit replay bearer (registered in OutputGuard before use). */
+export declare function defaultMintReplayBearer(): string;
+/**
+ * A fresh per-replay socket path under the OS temp dir. Delegates to
+ * {@link resolveReplaySocketPathIn} with the process temp dir so the bound is
+ * deterministically unit-testable with an injected base.
+ */
+export declare function defaultResolveReplaySocketPath(rootRunId: string): string;
+/**
+ * Resolve a fresh 0600 replay socket path under `baseTmpDir`. The basename is a
+ * short random hex (no runId embed); the socket chmod-0600s on bind. Only the
+ * basename is bounded by construction — a long `baseTmpDir` (macOS `tmpdir()` is a
+ * long `/var/folders/xx/…/T` path) can still push the FULL path past the unix
+ * `sun_path` limit, so when the preferred path would overflow, fall back to the
+ * short, always-present `/tmp` base. Exported + base-injected so the length bound
+ * is deterministically testable without touching the process env.
+ */
+export declare function resolveReplaySocketPathIn(baseTmpDir: string, _rootRunId: string): string;
+/**
+ * Build the re-spawn child env: the SAME `COMIS_ORCH_SOCKET`/`COMIS_CAP_LEASE`
+ * names a production run uses, but `COMIS_ORCH_SOCKET` is the SEPARATE replay
+ * socket path and `COMIS_CAP_LEASE` is the ephemeral replay bearer (INV-1). The
+ * two replay keys ALWAYS win over any inherited base env, so a base carrying the
+ * production socket/bearer can never leak into the re-spawn.
+ */
+export declare function buildReplayChildEnv(socketPath: string, bearer: string, baseEnv?: Record<string, string | undefined>): Record<string, string | undefined>;
+/**
+ * Run one deterministic replay of a durable orchestrate run. See the module
+ * docblock for the 6-step contract. Throws a content-free error on a validation
+ * failure (no re-spawn) and re-throws a re-spawn failure AFTER the socket is torn
+ * down in the `finally`.
+ */
+export declare function runOrchestrateReplaySession(deps: OrchestrateReplaySessionDeps, runId: string): Promise<{
+    stdout: string;
+    diverged?: boolean;
+}>;