comisai 1.0.44 → 1.0.46

package/node_modules/@comis/memory/dist/durable-run-store.d.ts

@@ -1,12 +1,11 @@
 /**
- * createSqliteDurableRunStore — SQLite persistence for the Phase-216 durable run
- * checkpoint (DUR-01/DUR-02/DUR-03/HB-01), implementing the `@comis/core`
- * {@link DurableRunPort}.
+ * createSqliteDurableRunStore — SQLite persistence for the durable run
+ * checkpoint, implementing the `@comis/core` {@link DurableRunPort}.
  *
  * Factory-function pattern (modeled wholesale on `createVideoJobStore`): prepares
  * fixed SQL statements once in the closure, returns a frozen `DurableRunPort`.
  * Reads go through `createRowMapper(DurableRunDbRowSchema)` so a corrupt row
- * degrades to a `Result.err`, never a throw (T-216-08); the JSON array columns
+ * degrades to a `Result.err`, never a throw; the JSON array columns
  * (`spawn_tree`/`caps`/`lease_ids`) are parsed inside a guard so a hand-edited /
  * truncated JSON column ALSO degrades to `err` rather than crashing the boot scan.
  *
@@ -14,21 +13,21 @@
  * `BoundedAutonomy`/`LeaseManager` FROM across a daemon restart: a row survives
  * the agent turn AND a restart because it lives on disk in the shared `memory.db`
  * (never an own .db). The `caps` column persists the ATTENUATED set (the result
- * of `attenuateCaps`) so a resume rehydrates it verbatim (DUR-03); the Plan-01
- * `parseDurableRunRecord` Zod union is the gate before any re-mint (T-216-06).
+ * of `attenuateCaps`) so a resume rehydrates it verbatim; the
+ * `parseDurableRunRecord` Zod union is the gate before any re-mint.
  *
- * NEW-1 (CRITICAL): the dedicated `outward_step` column is the SOLE monotonic
- * outward-send counter and is owned ENTIRELY by `allocateOutwardStep`.
- * `upsertCheckpoint` NEVER writes it, so a checkpoint between two outward sends
- * cannot reset it and re-introduce HIGH-1. `DurableRunRecord.stepIndex` maps onto
+ * The dedicated `outward_step` column is the SOLE monotonic outward-send counter
+ * and is owned ENTIRELY by `allocateOutwardStep`. `upsertCheckpoint` NEVER writes
+ * it, so a checkpoint between two outward sends cannot reset it and break the
+ * exactly-once send guarantee. `DurableRunRecord.stepIndex` maps onto
  * `outward_step` in `rowToRecord`; the column seeds at the -1 'never-sent'
  * sentinel, so a never-allocated run surfaces stepIndex -1 — which the domain
- * schema permits (`.min(-1)`, NEW-5), so it is NOT falsely orphaned. (LOW-1:
- * there is no coarse per-step index column — only `outward_step`.)
+ * schema permits (`.min(-1)`), so it is NOT falsely orphaned. There is no coarse
+ * per-step index column — only `outward_step`.
  *
- * SECURITY (T-216-05): the persisted columns carry NO secret — the lease
- * credential is held by the boot-bound adapter and is re-minted FRESH on resume;
- * only the attenuated caps + leaseId correlation are written here.
+ * SECURITY: the persisted columns carry NO secret — the lease credential is held
+ * by the boot-bound adapter and is re-minted FRESH on resume; only the attenuated
+ * caps + leaseId correlation are written here.
  *
  * @module
  */

package/node_modules/@comis/memory/dist/durable-run-store.js

@@ -1,13 +1,12 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * createSqliteDurableRunStore — SQLite persistence for the Phase-216 durable run
- * checkpoint (DUR-01/DUR-02/DUR-03/HB-01), implementing the `@comis/core`
- * {@link DurableRunPort}.
+ * createSqliteDurableRunStore — SQLite persistence for the durable run
+ * checkpoint, implementing the `@comis/core` {@link DurableRunPort}.
  *
  * Factory-function pattern (modeled wholesale on `createVideoJobStore`): prepares
  * fixed SQL statements once in the closure, returns a frozen `DurableRunPort`.
  * Reads go through `createRowMapper(DurableRunDbRowSchema)` so a corrupt row
- * degrades to a `Result.err`, never a throw (T-216-08); the JSON array columns
+ * degrades to a `Result.err`, never a throw; the JSON array columns
  * (`spawn_tree`/`caps`/`lease_ids`) are parsed inside a guard so a hand-edited /
  * truncated JSON column ALSO degrades to `err` rather than crashing the boot scan.
  *
@@ -15,21 +14,21 @@
  * `BoundedAutonomy`/`LeaseManager` FROM across a daemon restart: a row survives
  * the agent turn AND a restart because it lives on disk in the shared `memory.db`
  * (never an own .db). The `caps` column persists the ATTENUATED set (the result
- * of `attenuateCaps`) so a resume rehydrates it verbatim (DUR-03); the Plan-01
- * `parseDurableRunRecord` Zod union is the gate before any re-mint (T-216-06).
+ * of `attenuateCaps`) so a resume rehydrates it verbatim; the
+ * `parseDurableRunRecord` Zod union is the gate before any re-mint.
  *
- * NEW-1 (CRITICAL): the dedicated `outward_step` column is the SOLE monotonic
- * outward-send counter and is owned ENTIRELY by `allocateOutwardStep`.
- * `upsertCheckpoint` NEVER writes it, so a checkpoint between two outward sends
- * cannot reset it and re-introduce HIGH-1. `DurableRunRecord.stepIndex` maps onto
+ * The dedicated `outward_step` column is the SOLE monotonic outward-send counter
+ * and is owned ENTIRELY by `allocateOutwardStep`. `upsertCheckpoint` NEVER writes
+ * it, so a checkpoint between two outward sends cannot reset it and break the
+ * exactly-once send guarantee. `DurableRunRecord.stepIndex` maps onto
  * `outward_step` in `rowToRecord`; the column seeds at the -1 'never-sent'
  * sentinel, so a never-allocated run surfaces stepIndex -1 — which the domain
- * schema permits (`.min(-1)`, NEW-5), so it is NOT falsely orphaned. (LOW-1:
- * there is no coarse per-step index column — only `outward_step`.)
+ * schema permits (`.min(-1)`), so it is NOT falsely orphaned. There is no coarse
+ * per-step index column — only `outward_step`.
  *
- * SECURITY (T-216-05): the persisted columns carry NO secret — the lease
- * credential is held by the boot-bound adapter and is re-minted FRESH on resume;
- * only the attenuated caps + leaseId correlation are written here.
+ * SECURITY: the persisted columns carry NO secret — the lease credential is held
+ * by the boot-bound adapter and is re-minted FRESH on resume; only the attenuated
+ * caps + leaseId correlation are written here.
  *
  * @module
  */
@@ -42,17 +41,17 @@ import { DurableRunDbRowSchema } from "./durable-run-row-schema.js";
 // Row mapper (snake_case -> camelCase) + JSON-column parse guard
 // ---------------------------------------------------------------------------
 const durableRunMapper = createRowMapper(DurableRunDbRowSchema);
-// FLEET-03: the GROUP BY status COUNT(*) projection for countByStatus. No raw
+// The GROUP BY status COUNT(*) projection for countByStatus. No raw
 // `as Foo[]` cast (AGENTS §6.8) — a malformed aggregate row degrades to err.
 const statusCountRowSchema = z.strictObject({ status: z.string(), c: z.number() });
 const statusCountMapper = createRowMapper(statusCountRowSchema);
 /**
  * Map a validated DB row to the domain `DurableRunRecord`. Returns a `Result`
  * because the JSON array columns may be corrupt: a non-parseable
- * `spawn_tree`/`caps`/`lease_ids` degrades to `err` (T-216-08), never a throw.
+ * `spawn_tree`/`caps`/`lease_ids` degrades to `err`, never a throw.
  *
- * NEW-1/NEW-5/LOW-1: `record.stepIndex` maps from the `outward_step` column (the
- * sole counter; -1 seed surfaces as stepIndex -1 for a never-sent run).
+ * `record.stepIndex` maps from the `outward_step` column (the sole counter; -1
+ * seed surfaces as stepIndex -1 for a never-sent run).
  */
 function rowToRecord(row) {
     let spawnTree;
@@ -61,9 +60,9 @@ function rowToRecord(row) {
     try {
         // The JSON columns are TEXT on disk; parse them as-is. `spawn_tree` is EITHER
         // a flat string[] OR a DAG {nodeId,status,runId?}[] — JSON.parse preserves the
-        // shape; the Plan-01 spawnTree union validates both (do not coerce one into
-        // the other). Casts are to the domain field types; the Zod `parseDurableRunRecord`
-        // at the resume boundary (Plan 04/07) is the membership gate (T-216-06).
+        // shape; the spawnTree union validates both (do not coerce one into the
+        // other). Casts are to the domain field types; the Zod `parseDurableRunRecord`
+        // at the resume boundary is the membership gate.
         spawnTree = JSON.parse(row.spawn_tree);
         caps = JSON.parse(row.caps);
         leaseIds = JSON.parse(row.lease_ids);
@@ -78,10 +77,15 @@ function rowToRecord(row) {
         leaseIds,
         budgetConsumed: row.budget_consumed,
         cronOrigin: row.cron_origin,
-        // NEW-1/NEW-5: the idempotency-key field maps from the dedicated counter column.
+        // The idempotency-key field maps from the dedicated counter column.
         stepIndex: row.outward_step,
         status: row.status,
         lastHeartbeatAt: row.last_heartbeat_at,
+        // Additive resumable-orchestrate pointers. SQLite NULL (a pre-migration row or
+        // a non-orchestrate/never-checkpointed run) maps to `undefined` on the optional
+        // domain fields — never surfaced as a spurious null.
+        scriptRef: row.script_ref ?? undefined,
+        checkpointRef: row.checkpoint_ref ?? undefined,
     });
 }
 // ---------------------------------------------------------------------------
@@ -100,29 +104,48 @@ function rowToRecord(row) {
 export function createSqliteDurableRunStore(db, opts = {}) {
     const nowMs = opts.nowMs ?? systemNowMs;
     // --- Prepared statements ---
-    // DUR-01 idempotent upsert. NEW-1 (CRITICAL): the column list and the
-    // DO UPDATE SET clause DELIBERATELY OMIT `outward_step` — the counter is owned
-    // solely by allocateOutwardStep. On a fresh INSERT, outward_step takes the DDL
-    // default (-1, the NEW-5 sentinel); on CONFLICT, the SET clause leaves it
-    // untouched so a concurrent allocate's value survives. (LOW-1: there is no
-    // coarse per-step index column to write — the DDL has only outward_step.)
+    // Idempotent upsert. The column list and the DO UPDATE SET clause DELIBERATELY
+    // OMIT `outward_step` — the counter is owned solely by allocateOutwardStep. On
+    // a fresh INSERT, outward_step takes the DDL default (-1, the never-sent
+    // sentinel); on CONFLICT, the SET clause leaves it untouched so a concurrent
+    // allocate's value survives. There is no coarse per-step index column to
+    // write — the DDL has only outward_step.
+    //
+    // script_ref / checkpoint_ref use COALESCE(excluded.x, x) on CONFLICT: a bound
+    // NULL PRESERVES the existing value. This lets the checkpoint core set only
+    // checkpoint_ref and the resumable-timeout runner set only script_ref WITHOUT
+    // clobbering each other (the outcome_events COALESCE precedent). On a fresh
+    // INSERT the bound value (or NULL) is written directly.
+    //
+    // status uses a terminal-preserve CASE on CONFLICT: once a row is in a TERMINAL
+    // state ('revoked'/'completed'/'orphaned') a later upsert (every 233 caller binds
+    // status:'running' — the timeout markResumable + the jailed checkpoint()) MUST NOT
+    // resurrect it back to 'running'. Without this a timeout re-mark or a raced
+    // checkpoint landing after invalidateForRevoke would un-revoke the run and the
+    // boot sweep would re-surface/re-anchor a run the operator explicitly revoked. On
+    // a fresh INSERT the bound status is written directly (the CASE is DO-UPDATE-only).
     const upsertStmt = db.prepare(`
     INSERT INTO durable_runs (
       root_run_id, spawn_tree, caps, lease_ids, budget_consumed, cron_origin,
-      status, last_heartbeat_at, created_at_ms, updated_at_ms
-    ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      status, last_heartbeat_at, created_at_ms, updated_at_ms, script_ref, checkpoint_ref
+    ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
     ON CONFLICT(root_run_id) DO UPDATE SET
       spawn_tree = excluded.spawn_tree,
       caps = excluded.caps,
       lease_ids = excluded.lease_ids,
       budget_consumed = excluded.budget_consumed,
       cron_origin = excluded.cron_origin,
-      status = excluded.status,
+      status = CASE
+        WHEN durable_runs.status IN ('revoked', 'completed', 'orphaned') THEN durable_runs.status
+        ELSE excluded.status
+      END,
       last_heartbeat_at = excluded.last_heartbeat_at,
-      updated_at_ms = excluded.updated_at_ms
+      updated_at_ms = excluded.updated_at_ms,
+      script_ref = COALESCE(excluded.script_ref, script_ref),
+      checkpoint_ref = COALESCE(excluded.checkpoint_ref, checkpoint_ref)
   `);
     const getStmt = db.prepare(`SELECT * FROM durable_runs WHERE root_run_id = ?`);
-    // DUR-02 boot-resume scan — only status='running' (the partial index serves it).
+    // Boot-resume scan — only status='running' (the partial index serves it).
     const listResumableStmt = db.prepare(`
     SELECT * FROM durable_runs WHERE status = 'running' ORDER BY last_heartbeat_at ASC
   `);
@@ -136,16 +159,16 @@ export function createSqliteDurableRunStore(db, opts = {}) {
     const touchHeartbeatStmt = db.prepare(`
     UPDATE durable_runs SET last_heartbeat_at = ?, updated_at_ms = ? WHERE root_run_id = ?
   `);
-    // DUR-03 — a revoke flips the record to the terminal 'revoked' state so
+    // A revoke flips the record to the terminal 'revoked' state so
     // listResumable filters it out and resume can never re-mint pre-revoke caps.
     const invalidateForRevokeStmt = db.prepare(`
     UPDATE durable_runs SET status = 'revoked', orphan_reason = 'revoked', updated_at_ms = ?
     WHERE root_run_id = ?
   `);
-    // HIGH-1 / ONCE-02 — the ATOMIC monotonic outward-send counter. A single
-    // synchronous UPDATE ... RETURNING (better-sqlite3 supports RETURNING) so two
-    // sequential calls can never observe the same index. outward_step seeds at -1,
-    // so the first allocate yields 0. This is the SOLE writer of outward_step (NEW-1).
+    // The ATOMIC monotonic outward-send counter. A single synchronous
+    // UPDATE ... RETURNING (better-sqlite3 supports RETURNING) so two sequential
+    // calls can never observe the same index. outward_step seeds at -1, so the
+    // first allocate yields 0. This is the SOLE writer of outward_step.
     const allocateStmt = db.prepare(`
     UPDATE durable_runs SET outward_step = outward_step + 1, updated_at_ms = ?
     WHERE root_run_id = ? RETURNING outward_step
@@ -161,7 +184,7 @@ export function createSqliteDurableRunStore(db, opts = {}) {
   `);
     const allocCounterSchema = DurableRunDbRowSchema.pick({ outward_step: true });
     const allocCounterMapper = createRowMapper(allocCounterSchema);
-    // FLEET-03 — windowed status counts. Mirrors getRollingSpendUsd's `WHERE … >= ?`
+    // Windowed status counts. Mirrors getRollingSpendUsd's `WHERE … >= ?`
     // windowed aggregate: only rows updated within the fleet window are counted,
     // grouped by status. Prepared once; folded into the 4-key object (default 0).
     const countByStatusStmt = db.prepare(`
@@ -173,7 +196,10 @@ export function createSqliteDurableRunStore(db, opts = {}) {
             try {
                 const t = nowMs();
                 upsertStmt.run(record.rootRunId, JSON.stringify(record.spawnTree), JSON.stringify(record.caps), JSON.stringify(record.leaseIds), record.budgetConsumed, record.cronOrigin ?? null, record.status, record.lastHeartbeatAt, t, // created_at_ms (ignored on CONFLICT — PK row keeps its original)
-                t);
+                t, // updated_at_ms
+                // A bound NULL is COALESCE-preserved on CONFLICT (keeps a prior ref);
+                // written directly on a fresh INSERT.
+                record.scriptRef ?? null, record.checkpointRef ?? null);
                 return Promise.resolve(ok(undefined));
             }
             catch (e) {

package/node_modules/@comis/memory/dist/entity-resolver.d.ts

@@ -9,10 +9,10 @@
  * SQLite's built-in `lower()` is ASCII-only: it folds only A–Z, leaving
  * `lower('İSTANBUL')` → `'İstanbul'`, `lower('CAFÉ')` → `'cafÉ'`, and
  * `lower('ПРИВЕТ')` → `'ПРИВЕТ'` UNCHANGED. A `UNIQUE INDEX ON
- * (tenant_id, agent_id, lower(canonical_name))` (the original §4.2 spec) would
- * therefore treat `"İSTANBUL"`, `"İstanbul"`, `"istanbul"`, `"CAFÉ"`/`"café"`,
- * and `"ПРИВЕТ"`/`"привет"` as DISTINCT keys → duplicate entities → dedup
- * fails for exactly the Turkish/CJK/Cyrillic cases the criterion calls out.
+ * (tenant_id, agent_id, lower(canonical_name))` would therefore treat
+ * `"İSTANBUL"`, `"İstanbul"`, `"istanbul"`, `"CAFÉ"`/`"café"`, and
+ * `"ПРИВЕТ"`/`"привет"` as DISTINCT keys → duplicate entities → dedup fails for
+ * exactly the Turkish/CJK/Cyrillic cases this normalizer must collapse.
  *
  * The fix is to compute a normalized `canonical_key` HERE, in locale-independent
  * TypeScript, and UNIQUE-index that stored column instead. The transform is

package/node_modules/@comis/memory/dist/entity-resolver.js

@@ -10,10 +10,10 @@
  * SQLite's built-in `lower()` is ASCII-only: it folds only A–Z, leaving
  * `lower('İSTANBUL')` → `'İstanbul'`, `lower('CAFÉ')` → `'cafÉ'`, and
  * `lower('ПРИВЕТ')` → `'ПРИВЕТ'` UNCHANGED. A `UNIQUE INDEX ON
- * (tenant_id, agent_id, lower(canonical_name))` (the original §4.2 spec) would
- * therefore treat `"İSTANBUL"`, `"İstanbul"`, `"istanbul"`, `"CAFÉ"`/`"café"`,
- * and `"ПРИВЕТ"`/`"привет"` as DISTINCT keys → duplicate entities → dedup
- * fails for exactly the Turkish/CJK/Cyrillic cases the criterion calls out.
+ * (tenant_id, agent_id, lower(canonical_name))` would therefore treat
+ * `"İSTANBUL"`, `"İstanbul"`, `"istanbul"`, `"CAFÉ"`/`"café"`, and
+ * `"ПРИВЕТ"`/`"привет"` as DISTINCT keys → duplicate entities → dedup fails for
+ * exactly the Turkish/CJK/Cyrillic cases this normalizer must collapse.
  *
  * The fix is to compute a normalized `canonical_key` HERE, in locale-independent
  * TypeScript, and UNIQUE-index that stored column instead. The transform is

package/node_modules/@comis/memory/dist/file-secret-store.d.ts

@@ -1,6 +1,6 @@
 /**
  * FileSecretStore — SecretStorePort implementation with plaintext JSON storage.
- * File-mode is the documented plaintext-at-rest bargain (DESIGN §5.1).
+ * File-mode is the documented plaintext-at-rest bargain.
  * Writes are sync-atomic: unique-temp → O_NOFOLLOW open → fsync → rename → parent-dir fsync.
  * Single-writer invariant: all writes route through daemon-RPC.
  *

package/node_modules/@comis/memory/dist/file-secret-store.js

@@ -2,7 +2,7 @@
 // @allow-throw: createFileSecretStore path-containment guard; dataDir escaping the resolved base is a hard precondition violation (path traversal attack guard); the factory return type is SecretStorePort (not Result), so err() cannot be used here — this throw fires only for programmer errors at wiring time, never for user-supplied secret values.
 /**
  * FileSecretStore — SecretStorePort implementation with plaintext JSON storage.
- * File-mode is the documented plaintext-at-rest bargain (DESIGN §5.1).
+ * File-mode is the documented plaintext-at-rest bargain.
  * Writes are sync-atomic: unique-temp → O_NOFOLLOW open → fsync → rename → parent-dir fsync.
  * Single-writer invariant: all writes route through daemon-RPC.
  *

package/node_modules/@comis/memory/dist/hybrid-search.d.ts

@@ -27,17 +27,16 @@ export declare function buildFtsQuery(raw: string): string | null;
  * Search memories using FTS5 BM25 ranking.
  *
  * The single LTM chokepoint for BOTH `search()` (via hybridSearch) and
- * `searchLanes()` (via the adapter). Script routing (FTS-01, plan 180-06) wraps
- * the existing porter word lane: an all-Latin query (and the all-short "scan"
- * lane, which LTM has no machinery for) takes today's EXACT path — buildFtsQuery
- * → memory_fts MATCH, byte-identical SQL (I1); a non-Latin query routes to the
- * `memory_fts_tri` trigram twin when it is available, falling through to the
- * word lane on a trigram-absent host (status quo — preserves pre-existing
- * exact-word non-Latin matches). The trigram rank list has the same
- * `{id, rank}[]` shape, so it flows into computeRRF / hydrateLane unchanged.
+ * `searchLanes()` (via the adapter). Script routing wraps the porter word lane:
+ * an all-Latin query (and the all-short "scan" lane, which LTM has no machinery
+ * for) takes the word path — buildFtsQuery → memory_fts MATCH; a non-Latin query
+ * routes to the `memory_fts_tri` trigram twin when it is available, falling
+ * through to the word lane on a trigram-absent host (which preserves exact-word
+ * non-Latin matches). The trigram rank list has the same `{id, rank}[]` shape,
+ * so it flows into computeRRF / hydrateLane unchanged.
  *
- * LTM short-token-drop limitation (WR-02): the 180-01 router DROPS any
- * <3-codepoint normalized token from the trigram MATCH (a sub-floor token in an
+ * LTM short-token-drop limitation: the router DROPS any <3-codepoint normalized
+ * token from the trigram MATCH (a sub-floor token in an
  * AND/OR group cannot form a trigram and would contribute nothing). For the LCD
  * lane the dropped short token is preserved in `route.scanTokens` and the bounded
  * scan floor recovers it — but LTM has NO scan machinery and IGNORES `scanTokens`,
@@ -112,7 +111,7 @@ export interface HybridSearchOptions {
      * Read-side NL temporal-range filter. Epoch ms. ANDed onto the
      * post-fusion WHERE as `occurred_at BETWEEN ? AND ?` (bound params) — it
      * composes with the existing (tenant_id, agent_id) scope via ` AND `, so it
-     * can only NARROW, never widen scope (§5.2). NULL `occurred_at` rows fail
+     * can only NARROW, never widen scope. NULL `occurred_at` rows fail
      * BETWEEN and drop out (no event time ⇒ not in any range). Absent → no range
      * filter. NOT the temporal LANE (a post-search spread); this is a
      * pre-fetch filter — they compose, no double-apply.

package/node_modules/@comis/memory/dist/hybrid-search.js

@@ -93,7 +93,7 @@ export function buildFtsQuery(raw) {
     // Quote each token and join with OR for broad recall
     return meaningful.map((t) => `"${t}"`).join(" OR ");
 }
-// ── Trigram lane availability probe (FTS-01, plan 180-06) ────────────
+// ── Trigram lane availability probe ──────────────────────────────────
 /**
  * Probe-once-per-db cache for the `memory_fts_tri` trigram twin (mirrors the
  * `isFtsAvailable` WeakMap pattern in lcd-fts.ts:101-120). The twin is absent on
@@ -146,17 +146,16 @@ function searchByTrigram(db, match, limit) {
  * Search memories using FTS5 BM25 ranking.
  *
  * The single LTM chokepoint for BOTH `search()` (via hybridSearch) and
- * `searchLanes()` (via the adapter). Script routing (FTS-01, plan 180-06) wraps
- * the existing porter word lane: an all-Latin query (and the all-short "scan"
- * lane, which LTM has no machinery for) takes today's EXACT path — buildFtsQuery
- * → memory_fts MATCH, byte-identical SQL (I1); a non-Latin query routes to the
- * `memory_fts_tri` trigram twin when it is available, falling through to the
- * word lane on a trigram-absent host (status quo — preserves pre-existing
- * exact-word non-Latin matches). The trigram rank list has the same
- * `{id, rank}[]` shape, so it flows into computeRRF / hydrateLane unchanged.
+ * `searchLanes()` (via the adapter). Script routing wraps the porter word lane:
+ * an all-Latin query (and the all-short "scan" lane, which LTM has no machinery
+ * for) takes the word path — buildFtsQuery → memory_fts MATCH; a non-Latin query
+ * routes to the `memory_fts_tri` trigram twin when it is available, falling
+ * through to the word lane on a trigram-absent host (which preserves exact-word
+ * non-Latin matches). The trigram rank list has the same `{id, rank}[]` shape,
+ * so it flows into computeRRF / hydrateLane unchanged.
  *
- * LTM short-token-drop limitation (WR-02): the 180-01 router DROPS any
- * <3-codepoint normalized token from the trigram MATCH (a sub-floor token in an
+ * LTM short-token-drop limitation: the router DROPS any <3-codepoint normalized
+ * token from the trigram MATCH (a sub-floor token in an
  * AND/OR group cannot form a trigram and would contribute nothing). For the LCD
  * lane the dropped short token is preserved in `route.scanTokens` and the bounded
  * scan floor recovers it — but LTM has NO scan machinery and IGNORES `scanTokens`,
@@ -324,7 +323,7 @@ export function hybridSearch(db, query, queryEmbedding, options, vecAvailable) {
     const maxRrfScore = (weightFts + weightVec) / (k + 1);
     // ── Post-fusion filtering ──
     //
-    // `evicted_at IS NULL` is an ALWAYS-APPLIED base condition (FORGET-01): a
+    // `evicted_at IS NULL` is an ALWAYS-APPLIED base condition: a
     // soft-evicted memory (evicted_at set by the lifecycle sweep) is EXCLUDED from
     // EVERY recall path. This is the single most overlookable correctness gap — the
     // lifecycle sweep marking evicted_at is a silent no-op unless recall actually

package/node_modules/@comis/memory/dist/index.d.ts

@@ -69,6 +69,8 @@ export type { DurableRunStoreOptions } from "./durable-run-store.js";
 export { ensureDurableRunTable } from "./schema-durable-runs.js";
 export { createSqliteOutwardSendLedger } from "./outward-send-ledger-store.js";
 export { ensureOutwardLedgerTable } from "./schema-outward-ledger.js";
+export { createSqliteMsTeamsConversationStore } from "./msteams-conversation-store.js";
+export { ensureMsTeamsConversationTable } from "./schema-msteams-conversation.js";
 export { createSqliteDeliveryMirror } from "./delivery-mirror-adapter.js";
 export { createObservabilityStore } from "./observability-store/index.js";
 export type { ObservabilityStore, TokenUsageRow, DeliveryRow, DiagnosticRow, ChannelSnapshotRow, AuditEventRow, ProviderAggregation, AgentAggregation, SessionAggregation, HourlyBucket, QuarterHourBucket, CostBucketFilter, DeliveryStats, ObsTableName, ResetResult, PruneResult, SystemPromptReportRow, } from "./observability-store/index.js";

package/node_modules/@comis/memory/dist/index.js

@@ -5,23 +5,23 @@
 export { initSchema, isVecAvailable } from "./schema.js";
 // Session store
 export { createSessionStore } from "./session-store.js";
-// LCD lossless context store (ContextStorePort impl — Phase 127)
+// LCD lossless context store (ContextStorePort impl)
 export { createLcdStore, reconstructLcdMessage } from "./lcd-store.js";
-// LCD provenance READ adapter (LcdProvenanceReadStore impl — Phase 173, DIST-03
-// read side, the C1→C2 carry-in). The read-mirror of the write-side
-// buildProvenanceWrites; its own factory (NOT widened onto ContextStorePort) so
-// the recall import surface stays narrow. The daemon builds it on the same db
-// handle as createLcdStore and injects it as the core LcdProvenanceReadStore TYPE
-// (the agent↛memory cut) into createMemoryRecall's post-fusion provenance pass.
+// LCD provenance READ adapter (LcdProvenanceReadStore impl). The read-mirror of
+// the write-side buildProvenanceWrites; its own factory (NOT widened onto
+// ContextStorePort) so the recall import surface stays narrow. The daemon builds
+// it on the same db handle as createLcdStore and injects it as the core
+// LcdProvenanceReadStore TYPE (the agent↛memory cut) into createMemoryRecall's
+// post-fusion provenance pass.
 export { buildProvenanceReadStore } from "./lcd-store-provenance-read.js";
-// LCD FTS text renderer — exported for the offline doctor repair path (DOC-03,
-// Phase 171). The contentless lcd_messages_fts has no external content table so
-// the 'rebuild' idiom does not apply; the doctor repair re-derives FTS rows from
+// LCD FTS text renderer — exported for the offline doctor repair path. The
+// contentless lcd_messages_fts has no external content table so the 'rebuild'
+// idiom does not apply; the doctor repair re-derives FTS rows from
 // lcd_message_parts using this same render fn (mirror of the adapter populate path).
 export { renderMessageFtsText } from "./lcd-fts.js";
 // LCD read-only operator-browse adapter (ContextBrowsePort impl — context.* RPCs).
 export { createLcdBrowseStore } from "./lcd-browse-store.js";
-// LCD per-conversation single-flight ingest serializer (R3, Plan 132-04).
+// LCD per-conversation single-flight ingest serializer.
 // createIngestSerializer + IngestSerializer are NOT re-exported: the store
 // constructs the serializer internally (lcd-store.ts) and exposes its effect via
 // ContextStorePort.runOnConversation. No external consumer constructs one
@@ -73,11 +73,6 @@ export { createSqliteMemoryCausalStore } from "./sqlite-memory-causal-store.js";
 // memory adapter's db handle; the TripleStorePort TYPE lives in @comis/core (the
 // agent↛memory cut — the offline writer + the recall lane consume the type only).
 export { createSqliteTripleStore } from "./sqlite-triple-store.js";
-// (The directional relationship store (createSqliteRelationshipStore +
-//  MemoryRelationshipStoreDeps) — the sole RelationshipStore adapter over the
-//  `relationship` table — was DELETED in Phase 226 SIMPLIFY-03 with the rest of the
-//  social-modeling subsystem (the __SOCIAL_MODELING__ cron, the port, the table, the
-//  relationship-block prompt injection). No alias, I1.)
 // Scoped embedding-read store (sole MemoryEmbeddingStore impl).
 // Owns the (tenant, agent)-scoped LEFT JOIN vec_memories bulk read that hydrates
 // the MMR diversity re-rank (returns id->vector for the caller's scope ONLY — the
@@ -99,7 +94,7 @@ export { createSqliteMemoryConsolidationStore } from "./sqlite-memory-consolidat
 // MemoryUsefulnessStore port TYPE lives in @comis/core (the agent↛memory cut —
 // the recall scoring path consumes the type only).
 export { createSqliteMemoryUsefulnessStore } from "./sqlite-memory-usefulness-store.js";
-// Outcome-signal store (sole OutcomeSignalPort impl — v2.26 Verified Learning WS1).
+// Outcome-signal store (sole OutcomeSignalPort impl).
 // Owns the idempotent `observe()` write (deterministic-hash id + ON CONFLICT DO
 // NOTHING on the (tenant, agent, trajectory, source, observed_at) UNIQUE tuple),
 // the scoped precedence-first-then-confidence `resolve()` fusion (fail-closed
@@ -108,17 +103,16 @@ export { createSqliteMemoryUsefulnessStore } from "./sqlite-memory-usefulness-st
 // lives in @comis/core (the agent↛memory cut — outcome capture is daemon-side, a
 // future agent-side consumer consumes the port type only).
 export { createSqliteOutcomeStore } from "./sqlite-outcome-store.js";
-// Mental Model doc store (sole MentalModelStorePort impl — v2.31; generalized
-// from the v2.26 Verified Learning WS2 learned-skill store).
+// Mental Model doc store (sole MentalModelStorePort impl).
 // Owns the idempotent `admit()` upsert (deterministic-hash id of the
 // (tenant, agent, kind, topic_key, name) UNIQUE tuple + ON CONFLICT(id) DO
 // UPDATE), the scoped (tenant, agent)-isolated `get`/`list(scope, kind?)` reads,
 // and the `promote`/`demote`/`evict` lifecycle transitions (evict is SOFT — sets
 // evicted_at, never a hard DELETE). The DB CHECK (trust_level IN ('learned')) + a
-// code coercion make a learned doc structurally incapable of being `system`
-// (SEC-01). The daemon (composition root) constructs it on the memory adapter's
-// db handle (Plan 07); the MentalModelStorePort TYPE lives in @comis/core (the
-// agent↛memory cut — the synthesis job consumes the type only).
+// code coercion make a learned doc structurally incapable of being `system`.
+// The daemon (composition root) constructs it on the memory adapter's db handle;
+// the MentalModelStorePort TYPE lives in @comis/core (the agent↛memory cut — the
+// synthesis job consumes the type only).
 export { createSqliteMentalModelStore } from "./sqlite-mental-model-store.js";
 // Memory-lifecycle sweep store (sole MemoryLifecyclePort impl).
 // Owns the (tenant, agent)-scoped candidate scan over the `memories`
@@ -160,47 +154,52 @@ export { offlineOAuthProfileSet } from "./offline-oauth-write.js";
 export { createNamedGraphStore } from "./named-graph-store.js";
 // Delivery queue adapter
 export { createSqliteDeliveryQueue } from "./delivery-queue-adapter.js";
-// Video job store (durable async video-job lifecycle — Phase 189, JOB-01).
+// Video job store (durable async video-job lifecycle).
 // The SQLite-backed, agent-scoped, state-machine job store the background
-// poller (Plan 02) resumes against across a daemon restart; the video_status
-// handler (Plan 03) reads an agent-scoped row. Constructed on the shared
-// memory.db handle (like createSqliteDeliveryQueue). ensureVideoJobTable is the
-// idempotent DDL initSchema already calls; exported for the offline/test path.
+// poller resumes against across a daemon restart; the video_status handler reads
+// an agent-scoped row. Constructed on the shared memory.db handle (like
+// createSqliteDeliveryQueue). ensureVideoJobTable is the idempotent DDL initSchema
+// already calls; exported for the offline/test path.
 export { createVideoJobStore } from "./video-job-store.js";
 export { ensureVideoJobTable } from "./schema-video-jobs.js";
-// Durable run checkpoint store (Phase 216, DUR-01). The SQLite-backed
-// DurableRunPort the resume engine scans on boot (listResumable) and the daemon
-// wiring (Plan 07) constructs on the shared memory.db handle; ensureDurableRunTable
-// is the idempotent DDL initSchema calls — exported for the chaos/offline path.
+// Durable run checkpoint store. The SQLite-backed DurableRunPort the resume
+// engine scans on boot (listResumable) and the daemon wiring constructs on the
+// shared memory.db handle; ensureDurableRunTable is the idempotent DDL initSchema
+// calls — exported for the chaos/offline path.
 export { createSqliteDurableRunStore } from "./durable-run-store.js";
 export { ensureDurableRunTable } from "./schema-durable-runs.js";
-// Outward-send exactly-once ledger (Phase 216, ONCE-01). The SQLite-backed
-// OutwardSendLedgerPort the resume engine reconciles on boot (listUnreconciled)
-// and the send-wrap site (Plan 05) consults for the dedup short-circuit;
-// ensureOutwardLedgerTable is the idempotent DDL initSchema calls — exported for
-// the chaos/offline path.
+// Outward-send exactly-once ledger. The SQLite-backed OutwardSendLedgerPort the
+// resume engine reconciles on boot (listUnreconciled) and the send-wrap site
+// consults for the dedup short-circuit; ensureOutwardLedgerTable is the idempotent
+// DDL initSchema calls — exported for the chaos/offline path.
 export { createSqliteOutwardSendLedger } from "./outward-send-ledger-store.js";
 export { ensureOutwardLedgerTable } from "./schema-outward-ledger.js";
+// Conversation-reference store. The SQLite-backed MsTeamsConversationStorePort a
+// proactive send consults to recover {serviceUrl, tenantId, threadId} for a
+// conversation id; ensureMsTeamsConversationTable is the idempotent DDL initSchema
+// calls — exported for the offline/chaos path.
+export { createSqliteMsTeamsConversationStore } from "./msteams-conversation-store.js";
+export { ensureMsTeamsConversationTable } from "./schema-msteams-conversation.js";
 // Delivery mirror adapter
 export { createSqliteDeliveryMirror } from "./delivery-mirror-adapter.js";
 // Observability store
 export { createObservabilityStore } from "./observability-store/index.js";
-// AUDIT-01: the security-audit sink helpers the daemon's obs-persistence-wiring
-// consumes (the 0600 rotated JSONL writer + the default log basename). The
-// DEFAULT/MAX query-limit constants stay internal to the observability-store
-// barrel (impl detail — not re-surfaced here). `AuditQueryParams` is
-// ahead-of-consumer for Plan 05's obs.audit.query (policy-documented).
+// The security-audit sink helpers the daemon's obs-persistence-wiring consumes
+// (the 0600 rotated JSONL writer + the default log basename). The DEFAULT/MAX
+// query-limit constants stay internal to the observability-store barrel (impl
+// detail — not re-surfaced here). `AuditQueryParams` is ahead-of-consumer for the
+// obs.audit.query surface (policy-documented).
 export { appendAuditJsonl, SECURITY_AUDIT_LOG_BASENAME, } from "./observability-store/index.js";
-// PERSIST-01 (Phase 176 Plan 04): the cache-break row-builder + the rate-by-reason
-// analytics query the daemon's obs-persistence-wiring (the cache_break subscriber)
-// and the fleet/explain surfaces consume.
+// The cache-break row-builder + the rate-by-reason analytics query the daemon's
+// obs-persistence-wiring (the cache_break subscriber) and the fleet/explain
+// surfaces consume.
 export { cacheBreakEventToRow, queryCacheBreakRateByReason, } from "./observability-store/index.js";
-// Fleet window-rollup reducer (A2, v2.15 Phase 159). reduceFleetWindow is the
-// PURE cross-session reduce over the A1 SessionSummaryRollup[] (synthetic
-// excluded on the real `source` field). Barrel-surfaced AHEAD of its in-repo
-// consumer: the Phase-161 obs.fleet.health handler imports it, but no production
-// module references it yet — tracked in public-api-policy.ts as a planned orphan
-// (mirror FleetHealthReportSchema/FleetHealthReport from 159-04).
+// Fleet window-rollup reducer. reduceFleetWindow is the PURE cross-session reduce
+// over the SessionSummaryRollup[] (synthetic excluded on the real `source`
+// field). Barrel-surfaced AHEAD of its in-repo consumer: the obs.fleet.health
+// handler imports it, but no production module references it yet — tracked in
+// public-api-policy.ts as a planned orphan (mirror FleetHealthReportSchema/
+// FleetHealthReport).
 export { reduceFleetWindow } from "./observability-store/fleet-window-rollup.js";
 // Generic Row mapper factory.
 // Consumed via createRowMapper(schema) at every SQLite call-site to

package/node_modules/@comis/memory/dist/lcd-browse-store.d.ts

@@ -6,8 +6,8 @@
  * core/src/ports/context-store.ts ContextBrowsePort doc).
  *
  * The single capability: enumerate the distinct conversations one agent owns
- * within one tenant, most-recently-updated first, paginated. R4 (132-03 / WR-02):
- * every query filters by agent_id AND tenant_id so a conversation_id shared by
+ * within one tenant, most-recently-updated first, paginated. Tenant + agent
+ * isolation: every query filters by agent_id AND tenant_id so a conversation_id shared by
  * two agents (formatSessionKey omits agentId) never leaks across agents, and one
  * tenant never sees another's. Static SQL, bound params, no interpolated
  * identifiers; reads degrade gracefully (createRowMapper, no `as` casts —

package/node_modules/@comis/memory/dist/lcd-browse-store.js

@@ -7,8 +7,8 @@
  * core/src/ports/context-store.ts ContextBrowsePort doc).
  *
  * The single capability: enumerate the distinct conversations one agent owns
- * within one tenant, most-recently-updated first, paginated. R4 (132-03 / WR-02):
- * every query filters by agent_id AND tenant_id so a conversation_id shared by
+ * within one tenant, most-recently-updated first, paginated. Tenant + agent
+ * isolation: every query filters by agent_id AND tenant_id so a conversation_id shared by
  * two agents (formatSessionKey omits agentId) never leaks across agents, and one
  * tenant never sees another's. Static SQL, bound params, no interpolated
  * identifiers; reads degrade gracefully (createRowMapper, no `as` casts —
@@ -42,7 +42,7 @@ const totalRowMapper = createRowMapper(TotalRowSchema);
  * Assumes `initSchema()` has already created the `lcd_messages` table.
  */
 export function createLcdBrowseStore(db) {
-    // The distinct-conversation page, most-recently-updated first. R4: filter by
+    // The distinct-conversation page, most-recently-updated first. Filter by
     // agent_id AND tenant_id (the conversation_id prefix carries the tenant; the
     // explicit tenant_id is defense-in-depth). `session_key` is grouped via
     // MIN so the GROUP BY stays keyed on the conversation alone (one session per
@@ -70,7 +70,7 @@ export function createLcdBrowseStore(db) {
   `);
     return {
         listConversations(scope, opts) {
-            // WR-02: degrade PER ROW — a corrupt/drifted row is skipped, its siblings
+            // Degrade PER ROW — a corrupt/drifted row is skipped, its siblings
             // survive (never parseRows, which would discard every already-validated
             // row). Ordering is preserved (we iterate the ORDER BY result in order).
             const conversations = [];