comisai 1.0.44 → 1.0.46

package/node_modules/@comis/daemon/dist/wiring/setup-video-provider.js

@@ -1,26 +1,27 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * Video-provider SELECTION (RES-01/RES-02/RES-03/CRED-01, Phase 188 + 190).
+ * Video-provider SELECTION.
  *
  * `createVideoProviderSelector` returns a lazy getter (read-on-use at boot —
  * mirrors `createImageProviderSelector` in setup-image-provider.ts) that, per the
  * resolved config + the agent's main provider, decides between:
  *   - the skills FAL adapter (explicit `provider:"fal"`, via the `legacyGetter` →
  *     `createVideoGenProvider`); or
- *   - the follow-main LIVE adapter via the Plan-01 `resolveVideoProvider` (one
+ *   - the follow-main LIVE adapter via `resolveVideoProvider` (one
  *     source of truth), resolving creds from the SAME `SecretManager`/
- *     `OAuthTokenManager` the main provider uses (CRED-01 — no video-specific
- *     secret, I9): `auto`+`google`→`createVeoVideoAdapter` (GOOGLE_API_KEY,
+ *     `OAuthTokenManager` the main provider uses (no video-specific
+ *     secret): `auto`+`google`→`createVeoVideoAdapter` (GOOGLE_API_KEY,
  *     static-key) / `auto`+`xai`→`createGrokVideoAdapter` (XAI_API_KEY key-primary,
- *     with a defensive forward-looking SuperGrok-OAuth branch — A1: no xAI OAuth
+ *     with a defensive forward-looking SuperGrok-OAuth branch — no xAI OAuth
  *     provider is registered yet, so key-auth is the proven path); or
  *   - an honest-unavailable port (carrying the resolver's knob-naming hint) for a
- *     video-incapable main (RES-03), or for a capable main with no credential —
+ *     video-incapable main, or for a capable main with no credential —
  *     NEVER a misroute to a different paid provider, NEVER silence.
  *
  * The selector selects ONCE here (one source of truth — `resolveVideoProvider`);
- * the handler NEVER re-derives selection (the RES-01 keystone / the v2.20
- * keyless-summarizer two-source firewall). It reads creds via `SecretManager` /
+ * the handler NEVER re-derives selection (a single source of truth — a two-source
+ * firewall that prevents selection and credential resolution from diverging). It
+ * reads creds via `SecretManager` /
  * the `OAuthTokenManager`, never the raw environment.
  *
  * Placement: `@comis/daemon` (the boot selector is daemon-side; the FAL adapter
@@ -35,7 +36,7 @@ import { createVeoVideoAdapter } from "../api/veo-adapter.js";
 import { createGrokVideoAdapter, XAI_OAUTH_PROVIDER_ID } from "../api/grok-adapter.js";
 /**
  * A port whose every method returns a classified `VideoGenError` Result err —
- * the RES-03 honest-unavailable carrier. The agent gets a hint (naming the
+ * the honest-unavailable carrier. The agent gets a hint (naming the
  * binding config knob, or the missing credential for a capable main), not
  * silence. `isAvailable()` is `false` so callers that probe it know it cannot serve.
  */
@@ -60,7 +61,7 @@ export function makeUnavailableVideoPort(errorKind, hint, logger) {
  * key rotation requires a daemon restart to take effect (NOT live per-request;
  * parity with the image selector). Returns `undefined` only when video generation
  * is unconfigured (`videoGenConfig` absent) — a video-incapable main yields an
- * unavailable PORT (RES-03), never `undefined`, so the handler is still
+ * unavailable PORT, never `undefined`, so the handler is still
  * constructed and surfaces the hint.
  */
 export function createVideoProviderSelector(deps) {
@@ -74,21 +75,21 @@ export function createVideoProviderSelector(deps) {
         if (cfg.provider === "fal") {
             return deps.legacyGetter();
         }
-        // auto / google / xai → the follow-main path via the Plan-01 resolver (one
-        // source of truth; creds via the SecretManager closure — CRED-01).
+        // auto / google / xai → the follow-main path via the resolver (one
+        // source of truth; creds via the SecretManager closure).
         const sel = resolveVideoProvider(cfg, deps.mainProviderId, 
-        // CRED-01: video creds resolve from the SAME SecretManager/OAuthTokenManager
+        // Video creds resolve from the SAME SecretManager/OAuthTokenManager
         // the main provider uses. veo → GOOGLE_API_KEY; grok → XAI_API_KEY OR a
         // SuperGrok OAuth bearer (mirrors image's codex key-or-OAuth credsAvailable
-        // at setup-image-provider.ts:128-131); every other (explicit fal etc.) →
+        // in setup-image-provider.ts); every other (explicit fal etc.) →
         // FAL_KEY. A Google-only agent with no FAL_KEY resolves available on its
-        // existing GOOGLE_API_KEY (the design thesis — no video-specific secret, I9).
+        // existing GOOGLE_API_KEY (no video-specific secret).
         (videoApi) => {
             if (videoApi === "veo")
                 return deps.secretManager.get("GOOGLE_API_KEY") !== undefined;
             if (videoApi === "grok")
                 return (deps.secretManager.get("XAI_API_KEY") !== undefined ||
-                    // IN-02: gate on the adapter's exported provider-id constant (single
+                    // Gate on the adapter's exported provider-id constant (single
                     // source of truth) — never a bare "xai" literal that could drift.
                     (deps.oauthManager?.hasCredentials(XAI_OAUTH_PROVIDER_ID) ?? false));
             return deps.secretManager.get("FAL_KEY") !== undefined;
@@ -100,14 +101,14 @@ export function createVideoProviderSelector(deps) {
             ? deps.logger.info({ reason, step: "video_follow_main_skip" }, "Video follow-main resolution skipped")
             : deps.logger.debug({ reason, step: "video_fallback_skip" }, "Video fallback entry skipped"));
         if (!sel.ok) {
-            // RES-03 honest-unavailable: a port that surfaces the resolver's err (the
+            // Honest-unavailable: a port that surfaces the resolver's err (the
             // handler forwards its knob-naming hint). e.g. a video-incapable main
             // (openai) or explicit-but-no-creds.
             return makeUnavailableVideoPort(sel.errorKind, sel.hint, deps.logger);
         }
-        // VEO = the STATIC-KEY case (exactly like setup-image-provider.ts:183-192
-        // google-images). CRED-01: the SAME GOOGLE_API_KEY the completion + image
-        // paths use — no video-specific secret (I9). credsAvailable above already
+        // VEO = the STATIC-KEY case (exactly like the google-images path in
+        // setup-image-provider.ts). The SAME GOOGLE_API_KEY the completion + image
+        // paths use — no video-specific secret. credsAvailable above already
         // gated on GOOGLE_API_KEY, so `ok` implies a present key; the defensive guard
         // keeps the adapter's required `apiKey: string` honest rather than a `!`.
         if (sel.videoApi === "veo") {
@@ -124,8 +125,8 @@ export function createVideoProviderSelector(deps) {
         }
         // GROK = the KEY-OR-OAUTH case (mirrors image's codex branch). The key is the
         // PROVEN primary (XAI_API_KEY Bearer); the OAuth branch is built defensively
-        // codex-shaped so CRED-01's key-or-OAuth contract holds structurally, but it
-        // is forward-looking — A1: no xAI/SuperGrok OAuth provider is registered in
+        // codex-shaped so the key-or-OAuth contract holds structurally, but it
+        // is forward-looking — no xAI/SuperGrok OAuth provider is registered in
         // the codebase today, so `hasCredentials("xai")` no-ops, and GROK is NEVER
         // blocked on it. The adapter resolves the bearer (the selector never reads a
         // raw key into a log; the adapter's SEC tests prove the bearer is leak-free).
@@ -139,8 +140,8 @@ export function createVideoProviderSelector(deps) {
                 });
             }
             if (deps.oauthManager?.hasCredentials(XAI_OAUTH_PROVIDER_ID)) {
-                // Forward-looking (A1) — activates if/when an xAI OAuth provider exists.
-                // IN-02: same exported constant as the adapter resolves (no literal drift).
+                // Forward-looking — activates if/when an xAI OAuth provider exists.
+                // Same exported constant as the adapter resolves (no literal drift).
                 return createGrokVideoAdapter({
                     oauthManager: deps.oauthManager,
                     oauthProfiles: deps.oauthProfiles,

package/node_modules/@comis/daemon/dist/wiring/setup-worktree-sweep.d.ts

@@ -1,10 +1,10 @@
 /**
- * `setup-worktree-sweep` — the WT-02 worktree-orphan-sweep subsystem wiring.
+ * `setup-worktree-sweep` — the worktree-orphan-sweep subsystem wiring.
  *
- * `spawn --worktree` (WT-01) runs a child in an ISOLATED git worktree created off
+ * `spawn --worktree` runs a child in an ISOLATED git worktree created off
  * the child's jailed workspace. The happy path creates + auto-cleans-if-unchanged
  * inside one `executeSubAgent` call. But a CRASHED run (the daemon dies mid-child)
- * leaves the worktree + its `.git/worktrees/<name>` admin state orphaned. WT-02
+ * leaves the worktree + its `.git/worktrees/<name>` admin state orphaned. The sweep
  * reclaims those: a registry tracks every created worktree, and a boot (+ periodic)
  * sweep runs the lifecycle's CONSERVATIVE {@link sweepOrphans} — which removes ONLY
  * gone-from-disk or completed-AND-pristine entries and PRESERVES any dirty/ahead/
@@ -109,7 +109,7 @@ export interface WorktreeSweepHandle {
     shutdown(): void;
 }
 /**
- * Wire the WT-02 orphan sweep. `sweepNow()` runs the lifecycle's conservative
+ * Wire the orphan sweep. `sweepNow()` runs the lifecycle's conservative
  * {@link sweepOrphans} over the registry snapshot (so a removal during the pass
  * cannot mutate the iteration), and PRUNES reclaimed entries from the registry.
  * `startPeriodicSweep()` registers ONE `.unref()`'d interval; `shutdown()` cancels

package/node_modules/@comis/daemon/dist/wiring/setup-worktree-sweep.js

@@ -105,7 +105,7 @@ export function toLifecycleGitExec(execGit) {
 }
 const DEFAULT_SWEEP_INTERVAL_MS = 30 * 60_000;
 /**
- * Wire the WT-02 orphan sweep. `sweepNow()` runs the lifecycle's conservative
+ * Wire the orphan sweep. `sweepNow()` runs the lifecycle's conservative
  * {@link sweepOrphans} over the registry snapshot (so a removal during the pass
  * cannot mutate the iteration), and PRUNES reclaimed entries from the registry.
  * `startPeriodicSweep()` registers ONE `.unref()`'d interval; `shutdown()` cancels

package/node_modules/@comis/daemon/dist/wiring/terminal-drive-journal-persistence.d.ts

@@ -35,7 +35,7 @@ export interface DriveJournalPersistenceDeps {
 }
 /**
  * The confined per-agent journals dir:
- * `<dataDir>/terminal-drive/<agentId>/journals` (resolved Q2). Path-traversal
+ * `<dataDir>/terminal-drive/<agentId>/journals`. Path-traversal
  * guarded by `safePath` (a degenerate `dataDir`/`agentId` throws
  * `PathTraversalError`, which the callers swallow best-effort).
  */
@@ -50,13 +50,13 @@ export declare function driveJournalDir(dataDir: string, agentId: string): strin
  *
  * Best-effort: a failure (a `PathTraversalError` from a degenerate
  * `dataDir`/`agentId`, an unwritable target, a write fault) is SWALLOWED — it
- * must not propagate to the holder (165-07), which has already updated the
+ * must not propagate to the holder, which has already updated the
  * in-memory journal. The recovery scan simply misses this session. NEVER deletes
- * (I10 preserve-on-failure).
+ * (preserve-on-failure).
  */
 export declare function persistDriveJournal(deps: DriveJournalPersistenceDeps, agentId: string, sessionId: string, journal: DriveJournal): void;
 /**
- * The resume read (I10): load ONE drive's persisted journal.
+ * The resume read: load ONE drive's persisted journal.
  *
  * Returns `undefined` when the file is MISSING (no journal to resume); for a
  * corrupt/partial file returns {@link deserializeJournal}'s SAFE default (the
@@ -65,8 +65,8 @@ export declare function persistDriveJournal(deps: DriveJournalPersistenceDeps, a
  */
 export declare function loadDriveJournal(deps: DriveJournalPersistenceDeps, agentId: string, sessionId: string): DriveJournal | undefined;
 /**
- * Remove a drive's journal file from disk — the DISTINCT explicit call (I10:
- * persist/recover NEVER delete; only this does). Best-effort: ENOENT is swallowed
+ * Remove a drive's journal file from disk — the DISTINCT explicit call
+ * (persist/recover NEVER delete; only this does). Best-effort: ENOENT is swallowed
  * (already gone) and, per the module's all-best-effort contract, a genuine fault
  * is swallowed too (the in-memory holder is the source of truth; a lingering file
  * is overwritten/recovered next boot). NEVER throws — it is called off the

package/node_modules/@comis/daemon/dist/wiring/terminal-drive-journal-persistence.js

@@ -1,28 +1,26 @@
 // SPDX-License-Identifier: Apache-2.0
 // @allow-throw: NONE — this substrate is best-effort THROUGHOUT (unlike
 // terminal-wake-persistence.ts's removeWakeStateFile, which re-raises a genuine
-// non-ENOENT unlink fault). DUR-02's remove is called off the drive-cleanup path
+// non-ENOENT unlink fault). The remove is called off the drive-cleanup path
 // where a surfaced fs fault would abort an unrelated teardown; the in-memory
-// holder (165-07) is the source of truth, so a removal that cannot complete
+// holder is the source of truth, so a removal that cannot complete
 // degrades to "the file lingers and is overwritten/recovered next boot", never a
 // throw. ENOENT is swallowed (already gone); a genuine fault is logged-by-absence.
 /**
- * The DUR-02 DAEMON-side durable journal store — the single genuinely-new
- * capability of Phase 165.
+ * The DAEMON-side durable journal store.
  *
- * The Phase-164 rolling journal (`terminal-drive-journal.ts` in `@comis/skills`:
- * pure, bounded, content-free, total `serialize`/`deserialize`) was built
- * DUR-02-ready. This module adds the durable ATOMIC PERSISTENCE + recover-on-boot
+ * The rolling journal (`terminal-drive-journal.ts` in `@comis/skills`:
+ * pure, bounded, content-free, total `serialize`/`deserialize`) is designed for
+ * durable persistence. This module adds the durable ATOMIC PERSISTENCE + recover-on-boot
  * + resume read, so a 40h drive that crosses a daemon restart RESUMES from its
  * journal (objective + last classification + answered prompts + steps tried)
- * rather than starting over or re-answering prompts (I10). It WRAPS the shipped
- * pure `serializeJournal`/`deserializeJournal` — NO journal-shape rewrite
- * (CONTEXT §7.1.6 LOCKED).
+ * rather than starting over or re-answering prompts. It WRAPS the shipped
+ * pure `serializeJournal`/`deserializeJournal` — NO journal-shape rewrite.
  *
  * **Daemon-side placement (a deliberate CO-LOCATION CHOICE, NOT a forced
  * constraint).** The store lives in the daemon layer as a sibling of
  * `terminal-wake-persistence.ts` because it is co-located with the `driveJournals`
- * holder (`setup-terminal-wake.ts`, 165-07) + the daemon-side recover-on-boot
+ * holder (`setup-terminal-wake.ts`) + the daemon-side recover-on-boot
  * wiring — exactly where `terminal-wake-persistence.ts` already lives. The
  * `skills → observability` edge it would otherwise traverse is ALLOWED (the
  * architecture graph permits `skills: {shared, core, observability}`, and the MCP
@@ -43,29 +41,29 @@
  * session is missed on recover", never a throw (the wake-persistence semantics —
  * the in-memory holder has already updated).
  *
- * **The confined durable dir (resolved Q2):**
+ * **The confined durable dir:**
  * `<dataDir>/terminal-drive/<agentId>/journals/<sessionId>.json` — the confined
  * background-task per-agent pattern (runtime state OUT of the agent's
  * user-visible `<agentWs>/terminal/` workspace).
  *
- * **Content-free + secret-redacted (I3).** The journal is content-free BY
+ * **Content-free + secret-redacted.** The journal is content-free BY
  * CONSTRUCTION and the woken-turn driver runs `scrubSecretsFromText` UPSTREAM
  * before any tag/digest lands in it (`terminal-wake-turn.ts`); `clipTag`
  * byte-caps every field. This store does NOT re-redact — it persists the opaque,
  * already-redacted bytes verbatim and never re-structures them into a credential
- * field. The persisted file is mode-`0o600` in a `0o700` confined dir (V8).
+ * field. The persisted file is mode-`0o600` in a `0o700` confined dir.
  *
- * **I10 preserve-on-failure.** `persistDriveJournal` NEVER deletes a journal — a
+ * **Preserve-on-failure.** `persistDriveJournal` NEVER deletes a journal — a
  * genuinely-gone session keeps its journal for a fresh drive to pick up. {@link
  * removeDriveJournal} is a DISTINCT explicit call.
  *
- * **Per-session resume read (NO bulk recover).** DUR-02 resumes ONE journal per
+ * **Per-session resume read (NO bulk recover).** The store resumes ONE journal per
  * re-attach via {@link loadDriveJournal} — the wake holder seeds the in-memory
- * journal lazily on the first woken turn of a recovered session (165-REVIEW BL-02).
+ * journal lazily on the first woken turn of a recovered session.
  * There is deliberately NO bulk `recover(agentId)` scan: it had no production caller
  * (the resume design reads one journal per re-attach, not the whole agent set), so it
  * was removed per KISS/YAGNI (AGENTS.md §2.3 — no port methods without a concrete
- * caller; 165-REVIEW ME-03).
+ * caller).
  *
  * No raw timers / clock here — pure confined I/O (the `globals` architecture gate).
  *
@@ -82,7 +80,7 @@ export const DRIVE_DIR_NAME = "terminal-drive";
 export const JOURNALS_SUBDIR = "journals";
 /**
  * The confined per-agent journals dir:
- * `<dataDir>/terminal-drive/<agentId>/journals` (resolved Q2). Path-traversal
+ * `<dataDir>/terminal-drive/<agentId>/journals`. Path-traversal
  * guarded by `safePath` (a degenerate `dataDir`/`agentId` throws
  * `PathTraversalError`, which the callers swallow best-effort).
  */
@@ -135,9 +133,9 @@ function bestEffortFsync(deps, filePath) {
  *
  * Best-effort: a failure (a `PathTraversalError` from a degenerate
  * `dataDir`/`agentId`, an unwritable target, a write fault) is SWALLOWED — it
- * must not propagate to the holder (165-07), which has already updated the
+ * must not propagate to the holder, which has already updated the
  * in-memory journal. The recovery scan simply misses this session. NEVER deletes
- * (I10 preserve-on-failure).
+ * (preserve-on-failure).
  */
 export function persistDriveJournal(deps, agentId, sessionId, journal) {
     const ensure = deps.ensureContainedDir ?? obsEnsureContainedDir;
@@ -160,7 +158,7 @@ export function persistDriveJournal(deps, agentId, sessionId, journal) {
     }
 }
 /**
- * The resume read (I10): load ONE drive's persisted journal.
+ * The resume read: load ONE drive's persisted journal.
  *
  * Returns `undefined` when the file is MISSING (no journal to resume); for a
  * corrupt/partial file returns {@link deserializeJournal}'s SAFE default (the
@@ -187,8 +185,8 @@ export function loadDriveJournal(deps, agentId, sessionId) {
     return deserializeJournal(raw);
 }
 /**
- * Remove a drive's journal file from disk — the DISTINCT explicit call (I10:
- * persist/recover NEVER delete; only this does). Best-effort: ENOENT is swallowed
+ * Remove a drive's journal file from disk — the DISTINCT explicit call
+ * (persist/recover NEVER delete; only this does). Best-effort: ENOENT is swallowed
  * (already gone) and, per the module's all-best-effort contract, a genuine fault
  * is swallowed too (the in-memory holder is the source of truth; a lingering file
  * is overwritten/recovered next boot). NEVER throws — it is called off the

package/node_modules/@comis/daemon/dist/wiring/terminal-drive-scope.d.ts

@@ -1,19 +1,19 @@
 /**
- * The pure daemon-wiring drive-scope helpers (DRIVE-01; design §7.1.1, 164-06 Task 1) —
+ * The pure daemon-wiring drive-scope helpers —
  * the TWO-OWNER SPLIT that lets a promoted drive's fd3-woken turns run under a dedicated
  * `drive:<sessionId>` attribution key WITHOUT changing which session (or jail) the registry
  * resolves.
  *
- * The load-bearing nuance (objective of 164-06): a woken turn keeps two owners distinct.
+ * The load-bearing nuance: a woken turn keeps two owners distinct.
  *   1. The **registry owner** ({@link registryOwnerFor}) — the `(agentId, sessionKey)` the
  *      registry's `get`/`status`/`read`/`sendText` are scoped by. It MUST stay the session's
  *      STAMPED owner (`sessionKey:""` for the forcing use case), because `ownedHandle`
  *      returns not-found on ANY owner mismatch (`sameOwner`, terminal-session-registry.ts:549).
  *      If a *drive*-scoped `sessionKey` (≠ the stamped `""`) reached the registry, `read`/
- *      `status` would return the empty `alive:false` not-found view and drive nothing (the
- *      I9-class silent strand — T-164-19/T-164-23). The same `allowId`/`scope`/`uid` (stamped
- *      ONCE at create, never re-derived on the wake path) therefore apply → I5 (WHERE not
- *      WHAT) by construction.
+ *      `status` would return the empty `alive:false` not-found view and drive nothing (a
+ *      silent strand). The same `allowId`/`scope`/`uid` (stamped
+ *      ONCE at create, never re-derived on the wake path) therefore apply — scoping WHERE,
+ *      not WHAT, by construction.
  *   2. The **drive-scope key** ({@link driveScopeKeyFor} → `drive:<sessionId>`) — what the FSM
  *      dedupe + the journal keying + the conversation/LCD attribution use. This is the
  *      isolation mechanism (a promoted drive's woken turns no longer pollute the user's
@@ -21,11 +21,11 @@
  *
  * {@link DRIVE_SCOPE_PREFIX} is a RESERVED prefix the session-key formatter never produces
  * (`formatSessionKey` emits `{tenantId}:{userId}:{channelId}…`; a subagent's channelId is
- * `sub-agent:<uuid>`, so a real owner key never starts with `drive:` — A4 / T-164-20). The
+ * `sub-agent:<uuid>`, so a real owner key never starts with `drive:`). The
  * drive-scope attribution key therefore cannot collide with a real subagent owner; the
  * registry owner-gate stays the authorization boundary.
  *
- * Architecture invariants (binding — AGENTS.md / 124 house style; mirrors the pure,
+ * Architecture invariants (binding — AGENTS.md house style; mirrors the pure,
  * never-throw daemon-wiring helpers in `terminal-wake-persistence.ts`):
  *   - PURE: free functions, NOT a factory. NO clock/timer reads, NO module-global mutable
  *     state, NO I/O.
@@ -44,15 +44,15 @@ import type { PersistedWakeOwner } from "./terminal-wake-persistence.js";
  * The reserved attribution-key prefix for a promoted drive's woken turns
  * (`drive:<sessionId>`). `formatSessionKey` NEVER produces a value starting with this
  * prefix (a real owner key is `{tenantId}:{userId}:{channelId}…`), so a drive-scope key
- * cannot collide with a real subagent owner (A4 / T-164-20). The trailing colon makes the
+ * cannot collide with a real subagent owner. The trailing colon makes the
  * prefix-check unambiguous (a session id cannot smuggle a leading `drive` segment).
  */
 export declare const DRIVE_SCOPE_PREFIX = "drive:";
 /**
  * Derive the drive-scope attribution `sessionKey` for a session's woken turn. Returns
  * `drive:<sessionId>` when the session is promoted (so its woken turns are isolated to the
- * dedicated drive scope, NOT the primary `sessionKey:""` conversation), else `""` (today's
- * inline path — byte-identical, I1).
+ * dedicated drive scope, NOT the primary `sessionKey:""` conversation), else `""` (the
+ * inline path — byte-identical).
  *
  * This is ONLY the FSM/journal/conversation attribution key; it is NEVER the
  * registry-authorization owner ({@link registryOwnerFor} strips it back for registry calls).
@@ -65,8 +65,8 @@ export declare function driveScopeKeyFor(sessionId: string, promoted: boolean):
 /**
  * Is this wake owner drive-scoped (its `sessionKey` carries the reserved
  * {@link DRIVE_SCOPE_PREFIX})? The SINGLE total accessor for the drive-scope test — used by
- * both {@link registryOwnerFor} (the strip) and the woken-turn driver's `promoted` gate
- * (IN-03), so ALL registry-owner resolution applies the identical defensive narrow.
+ * both {@link registryOwnerFor} (the strip) and the woken-turn driver's `promoted` gate,
+ * so ALL registry-owner resolution applies the identical defensive narrow.
  *
  * Total + never throws: a degenerate owner (`undefined`, a missing/non-string `sessionKey`)
  * yields `false` — the woken-turn driver + the active-check evaluate this on EVERY wake, so a
@@ -78,8 +78,8 @@ export declare function driveScopeKeyFor(sessionId: string, promoted: boolean):
  */
 export declare function isDriveScoped(owner: PersistedWakeOwner): boolean;
 /**
- * Strip a `drive:`-scoped wake owner back to the session's STAMPED registry owner — the I5
- * anchor. A `sessionKey` starting with {@link DRIVE_SCOPE_PREFIX} is collapsed to the
+ * Strip a `drive:`-scoped wake owner back to the session's STAMPED registry owner — the
+ * stamped-owner anchor. A `sessionKey` starting with {@link DRIVE_SCOPE_PREFIX} is collapsed to the
  * stamped `""` (the forcing use case's owner), so the registry resolves the LIVE session
  * with its create-time `allowId`/`scope`/`uid`, never the not-found view. A `sessionKey`
  * NOT starting with the reserved prefix (a real subagent owner, or the today-path `""`)

package/node_modules/@comis/daemon/dist/wiring/terminal-drive-scope.js

@@ -1,20 +1,20 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * The pure daemon-wiring drive-scope helpers (DRIVE-01; design §7.1.1, 164-06 Task 1) —
+ * The pure daemon-wiring drive-scope helpers —
  * the TWO-OWNER SPLIT that lets a promoted drive's fd3-woken turns run under a dedicated
  * `drive:<sessionId>` attribution key WITHOUT changing which session (or jail) the registry
  * resolves.
  *
- * The load-bearing nuance (objective of 164-06): a woken turn keeps two owners distinct.
+ * The load-bearing nuance: a woken turn keeps two owners distinct.
  *   1. The **registry owner** ({@link registryOwnerFor}) — the `(agentId, sessionKey)` the
  *      registry's `get`/`status`/`read`/`sendText` are scoped by. It MUST stay the session's
  *      STAMPED owner (`sessionKey:""` for the forcing use case), because `ownedHandle`
  *      returns not-found on ANY owner mismatch (`sameOwner`, terminal-session-registry.ts:549).
  *      If a *drive*-scoped `sessionKey` (≠ the stamped `""`) reached the registry, `read`/
- *      `status` would return the empty `alive:false` not-found view and drive nothing (the
- *      I9-class silent strand — T-164-19/T-164-23). The same `allowId`/`scope`/`uid` (stamped
- *      ONCE at create, never re-derived on the wake path) therefore apply → I5 (WHERE not
- *      WHAT) by construction.
+ *      `status` would return the empty `alive:false` not-found view and drive nothing (a
+ *      silent strand). The same `allowId`/`scope`/`uid` (stamped
+ *      ONCE at create, never re-derived on the wake path) therefore apply — scoping WHERE,
+ *      not WHAT, by construction.
  *   2. The **drive-scope key** ({@link driveScopeKeyFor} → `drive:<sessionId>`) — what the FSM
  *      dedupe + the journal keying + the conversation/LCD attribution use. This is the
  *      isolation mechanism (a promoted drive's woken turns no longer pollute the user's
@@ -22,11 +22,11 @@
  *
  * {@link DRIVE_SCOPE_PREFIX} is a RESERVED prefix the session-key formatter never produces
  * (`formatSessionKey` emits `{tenantId}:{userId}:{channelId}…`; a subagent's channelId is
- * `sub-agent:<uuid>`, so a real owner key never starts with `drive:` — A4 / T-164-20). The
+ * `sub-agent:<uuid>`, so a real owner key never starts with `drive:`). The
  * drive-scope attribution key therefore cannot collide with a real subagent owner; the
  * registry owner-gate stays the authorization boundary.
  *
- * Architecture invariants (binding — AGENTS.md / 124 house style; mirrors the pure,
+ * Architecture invariants (binding — AGENTS.md house style; mirrors the pure,
  * never-throw daemon-wiring helpers in `terminal-wake-persistence.ts`):
  *   - PURE: free functions, NOT a factory. NO clock/timer reads, NO module-global mutable
  *     state, NO I/O.
@@ -43,15 +43,15 @@
  * The reserved attribution-key prefix for a promoted drive's woken turns
  * (`drive:<sessionId>`). `formatSessionKey` NEVER produces a value starting with this
  * prefix (a real owner key is `{tenantId}:{userId}:{channelId}…`), so a drive-scope key
- * cannot collide with a real subagent owner (A4 / T-164-20). The trailing colon makes the
+ * cannot collide with a real subagent owner. The trailing colon makes the
  * prefix-check unambiguous (a session id cannot smuggle a leading `drive` segment).
  */
 export const DRIVE_SCOPE_PREFIX = "drive:";
 /**
  * Derive the drive-scope attribution `sessionKey` for a session's woken turn. Returns
  * `drive:<sessionId>` when the session is promoted (so its woken turns are isolated to the
- * dedicated drive scope, NOT the primary `sessionKey:""` conversation), else `""` (today's
- * inline path — byte-identical, I1).
+ * dedicated drive scope, NOT the primary `sessionKey:""` conversation), else `""` (the
+ * inline path — byte-identical).
  *
  * This is ONLY the FSM/journal/conversation attribution key; it is NEVER the
  * registry-authorization owner ({@link registryOwnerFor} strips it back for registry calls).
@@ -66,8 +66,8 @@ export function driveScopeKeyFor(sessionId, promoted) {
 /**
  * Is this wake owner drive-scoped (its `sessionKey` carries the reserved
  * {@link DRIVE_SCOPE_PREFIX})? The SINGLE total accessor for the drive-scope test — used by
- * both {@link registryOwnerFor} (the strip) and the woken-turn driver's `promoted` gate
- * (IN-03), so ALL registry-owner resolution applies the identical defensive narrow.
+ * both {@link registryOwnerFor} (the strip) and the woken-turn driver's `promoted` gate,
+ * so ALL registry-owner resolution applies the identical defensive narrow.
  *
  * Total + never throws: a degenerate owner (`undefined`, a missing/non-string `sessionKey`)
  * yields `false` — the woken-turn driver + the active-check evaluate this on EVERY wake, so a
@@ -81,8 +81,8 @@ export function isDriveScoped(owner) {
     return typeof owner?.sessionKey === "string" && owner.sessionKey.startsWith(DRIVE_SCOPE_PREFIX);
 }
 /**
- * Strip a `drive:`-scoped wake owner back to the session's STAMPED registry owner — the I5
- * anchor. A `sessionKey` starting with {@link DRIVE_SCOPE_PREFIX} is collapsed to the
+ * Strip a `drive:`-scoped wake owner back to the session's STAMPED registry owner — the
+ * stamped-owner anchor. A `sessionKey` starting with {@link DRIVE_SCOPE_PREFIX} is collapsed to the
  * stamped `""` (the forcing use case's owner), so the registry resolves the LIVE session
  * with its create-time `allowId`/`scope`/`uid`, never the not-found view. A `sessionKey`
  * NOT starting with the reserved prefix (a real subagent owner, or the today-path `""`)

package/node_modules/@comis/daemon/dist/wiring/terminal-durable-wiring.d.ts

@@ -1,30 +1,31 @@
 /**
- * The DUR-01 / DUR-02 / LIVE-01 / ENDURE-01 daemon DURABILITY WIRING (165-07 Task 4) — the
- * integration glue that ties the phase's pure siblings + durable stores into the live
- * registry + wake seams. Extracted from `setup-terminal-tools.ts` to keep that file under the
- * 800-line architecture cap; the wiring is exercised by the registry/wake/reaper unit suites
- * + the integration tier (no unit test of its own — it is composition, not logic).
+ * The daemon DURABILITY WIRING for terminal drives — the integration glue that ties the pure
+ * durability siblings + durable stores into the live registry + wake seams. Extracted from
+ * `setup-terminal-tools.ts` to keep that file under the 800-line architecture cap; the wiring
+ * is exercised by the registry/wake/reaper unit suites + the integration tier (no unit test of
+ * its own — it is composition, not logic).
  *
  * Two construction sites:
  *   1. {@link buildAgentTerminalDurability} — PER-AGENT (called from `getOrCreateTerminalRegistry`):
- *      the descriptor store (165-07 Task 1) + the `has-session` probe + the recover/unrecoverable
- *      hooks (→ the registry's `durability` dep, consumed by 165-06's recover-on-boot + the
- *      durable-aware lost gate) + the `isBusy` reaper predicate (165-08's seam, bound to 165-02's
+ *      the descriptor store + the `has-session` probe + the recover/unrecoverable
+ *      hooks (→ the registry's `durability` dep, consumed by recover-on-boot + the
+ *      durable-aware lost gate) + the `isBusy` reaper predicate (bound to
  *      `busyOrHung`). On a re-attach it emits the content-free `terminal:drive_reattached`
- *      (I5 same-allow-entry, I3 ids-only); on a genuinely-gone session it emits the EXISTING
- *      `terminal:session_state(state:"lost")` + a content-free unrecoverable reason (NOTIFY-01
- *      layers the user-facing `failed` downstream).
+ *      (the re-attach runs under the SAME persisted allow-entry; the record carries ids only);
+ *      on a genuinely-gone session it emits the EXISTING
+ *      `terminal:session_state(state:"lost")` + a content-free unrecoverable reason (the wake
+ *      notify layer adds the user-facing `failed` downstream).
  *   2. {@link buildWakeDurabilityDeps} — DAEMON-WIDE (spread into `setupTerminalWake`): the
- *      DUR-02 journal store (165-07 Task 1, the persist-on-set + resume-on-re-attach point) +
- *      the LIVE-01 `checkLiveness` (the worker `status` round-trip mapped to a `BusySignal` — a
- *      CLASSIFIER perception, NEVER a screen read, I2) + the `refreshLastActivity` unify (a busy
+ *      drive-journal store (the persist-on-set + resume-on-re-attach point) +
+ *      the `checkLiveness` backstop (the worker `status` round-trip mapped to a `BusySignal` — a
+ *      CLASSIFIER perception, NEVER a screen read) + the lastActivity unify (a busy
  *      backstop verdict advances the handle's lastActivity so the idle reaper never evicts a
- *      quiet-but-busy compile, I9).
+ *      quiet-but-busy compile).
  *
  * The `isTmuxAlive` probe is the daemon-side `tmux has-session -t comis-<id>` (exit 0 ⇒ alive),
  * resolved against a `tmuxPath` the composition root detects once (`which tmux`). Absent tmux
- * ⇒ the probe is always-false (a durable session degrades to today's lost floor at runtime —
- * §7.1.5's runtime fallback, NOT a config-time hard-require, I1).
+ * ⇒ the probe is always-false (a durable session degrades to the lost floor at runtime —
+ * a runtime fallback, NOT a config-time hard-require).
  *
  * @module
  */
@@ -60,11 +61,10 @@ export declare function resolveDaemonTmuxPath(): string | undefined;
 /**
  * Build the daemon-side `has-session` liveness probe: `tmux -S <socket> has-session -t
  * comis-<id>` (exit 0 ⇒ alive). Returns `false` on ANY non-zero exit / throw (the SAFE
- * direction — a probe that cannot confirm alive must never assert it, mirroring 165-01's
- * bias). Absent `tmuxPath` ⇒ always-false (a durable session falls back to the lost floor
- * at runtime, I1).
+ * direction — a probe that cannot confirm alive must never assert it). Absent `tmuxPath` ⇒
+ * always-false (a durable session falls back to the lost floor at runtime).
  *
- * DUR-01: the probe MUST target the SAME `-S` socket the worker binds
+ * The probe MUST target the SAME `-S` socket the worker binds
  * (`<dataDir>/terminal-worker/tmux.sock`) — NOT tmux's default /tmp socket. systemd
  * `PrivateTmp=yes` privatizes /tmp per daemon start, so a default-socket probe in the
  * restarted daemon would find NOTHING and falsely declare every survived durable session
@@ -82,7 +82,7 @@ export declare function buildIsTmuxAlive(tmuxPath: string | undefined, socketPat
  */
 export declare function buildKillTmux(tmuxPath: string | undefined, socketPath: string, run?: (bin: string, args: string[]) => void): (name: string, socket?: string) => void;
 /**
- * RECUR-02 (live VPS 2026-06-17) — the stranded-mount-namespace predicate. A durable tmux
+ * The stranded-mount-namespace predicate. A durable tmux
  * server kept alive across a daemon restart by `KillMode=process` was forked by the PRIOR
  * daemon generation, so it lives in that generation's mount namespace. systemd `PrivateTmp`/
  * `ProtectHome`/`ProtectSystem` give EVERY daemon START a fresh mount ns, so after a restart the
@@ -112,7 +112,7 @@ export interface RecreateStrandedTmuxDeps {
     killServer?: (socketPath: string) => void;
 }
 /**
- * RECUR-02 — at daemon boot, if the durable tmux server SURVIVED into a stranded prior-generation
+ * At daemon boot, if the durable tmux server SURVIVED into a stranded prior-generation
  * mount namespace ({@link isTmuxServerStranded}), tear it down (`kill-server`) so the next
  * `new-session` starts a FRESH server in THIS daemon's live ns (where new `bwrap` sessions work).
  * Its surviving durable sessions are intentionally killed — they would otherwise be a half-dead
@@ -127,7 +127,7 @@ export declare function recreateStrandedTmuxServerOnBoot(deps: RecreateStrandedT
     killed: boolean;
 };
 /**
- * RECUR-02 — the dataDir-bound boot step the composition root calls ONCE before any registry's
+ * The dataDir-bound boot step the composition root calls ONCE before any registry's
  * recover-on-boot. Resolves the daemon tmux path + the durable `-S` socket (the SAME derivation
  * the liveness probe uses) and delegates to {@link recreateStrandedTmuxServerOnBoot}. Thin
  * composition (no logic of its own — the decision is unit-tested on the delegate), mirroring the
@@ -156,16 +156,16 @@ export interface AgentTerminalDurabilityInputs {
  * Build the per-agent registry `durability` dep + the reaper `isBusy` predicate.
  *
  * `durability` (→ `createTerminalSessionRegistry`): the descriptor store + the `has-session`
- * probe + the two content-free hooks. `onReattached` → `terminal:drive_reattached` (I5 — the
+ * probe + the two content-free hooks. `onReattached` → `terminal:drive_reattached` (the
  * re-attach runs under the SAME persisted allow-entry; the emit carries ids only). On a
  * genuinely-gone durable session `onUnrecoverable` → the EXISTING `terminal:session_state(
- * state:"lost")` + a content-free unrecoverable reason (NO `failed` member; NOTIFY-01 layers it).
+ * state:"lost")` + a content-free unrecoverable reason (NO `failed` member; the wake notify layer adds it).
  *
- * `isBusy` (→ the reaper, 165-08's seam): bound to 165-02's `busyOrHung` over the session's
- * `alive` (the handle is still `running` AND, for a durable session, its tmux is alive) + the
- * progress window (`nowMs - lastActivity`, which the LIVE-01 backstop keeps fresh for a
- * genuinely-busy compile via `checkLiveness`/`refreshLastActivity`). So a quiet-but-busy
- * multi-hour build is excluded from idle eviction (I9), while a genuinely-idle session is not.
+ * `isBusy` (→ the reaper): bound to `busyOrHung` over the session's `alive` (the handle is still
+ * `running` AND, for a durable session, its tmux is alive) + the progress window (`nowMs -
+ * lastActivity`, which the liveness backstop keeps fresh for a genuinely-busy compile via
+ * `checkLiveness`). So a quiet-but-busy multi-hour build is excluded from idle eviction, while a
+ * genuinely-idle session is not.
  */
 export declare function buildAgentTerminalDurability(i: AgentTerminalDurabilityInputs): {
     durability: TerminalDurabilityDeps;
@@ -174,7 +174,7 @@ export declare function buildAgentTerminalDurability(i: AgentTerminalDurabilityI
         lastActivity: number;
     }) => boolean;
 };
-/** Inputs for the daemon-wide wake durability deps (the journal store + the LIVE-01 probes). */
+/** Inputs for the daemon-wide wake durability deps (the journal store + the liveness probes). */
 export interface WakeDurabilityInputs {
     readonly dataDir: string;
     readonly registries: ReadonlyMap<string, TerminalSessionRegistry>;
@@ -213,23 +213,6 @@ export declare function buildTerminalWakeDurability(i: {
     notifyPolicy: "terminal" | "all" | "none";
     heartbeatNotifyMs: number;
 };
-/**
- * Build the daemon-wide DUR-02 journal store + the LIVE-01 `checkLiveness`/`refreshLastActivity`
- * the wake holder consumes (spread into `setupTerminalWake`).
- *
- * - `driveJournalStore`: a thin `DriveJournalStorePort` wrapping the 165-04 fs-safe module
- *   functions bound to `dataDir` (persist-on-set + recover/load on re-attach + the explicit-only
- *   remove). Best-effort/total throughout (the module swallows faults).
- * - `checkLiveness(sessionId, agentId)`: the LIVE-01 single liveness check — the registry
- *   `status` round-trip (the worker's CLASSIFIER perception — `working`/`stuck`/`exited` — NOT a
- *   screen read, I2) mapped to a `BusySignal`. A `stuck` classifier verdict → `noProgressMs >
- *   stuckMs` → hung; `working`/`awaiting-input` → busy; `exited`/gone → not alive → hung. The
- *   `status` round-trip ALSO stamps the handle's `lastActivity` as a side effect (the registry's
- *   status method) — that IS the ENDURE-01 idle-reaper unify (I9): a busy verdict's liveness
- *   check refreshes lastActivity, so the idle sweep never evicts a quiet-but-busy compile. No
- *   SEPARATE refresh hook is needed (165-REVIEW LO-03 removed the redundant `refreshLastActivity`
- *   dep that double-stamped what `status` already does).
- */
 export declare function buildWakeDurabilityDeps(i: WakeDurabilityInputs): {
     driveJournalStore: DriveJournalStorePort;
     checkLiveness: (sessionId: string, agentId: string) => Promise<LivenessSignal | undefined>;