comisai 1.0.44 → 1.0.46

package/node_modules/@comis/memory/dist/lcd-fts.d.ts

@@ -1,27 +1,27 @@
 /**
- * FTS5 search helper for the LCD (Lossless Context DAG) lossless store (Phase
- * 131, E1 `ctx_search`). Extracted from `lcd-store.ts` so the adapter stays
- * under the 800-line file-size cap (Pitfall 6).
+ * FTS5 search helper for the LCD (Lossless Context DAG) lossless store — the
+ * `ctx_search` surface. Extracted from `lcd-store.ts` so the adapter stays
+ * under the 800-line file-size cap.
  *
  * Two responsibilities:
  *   1. `renderMessageFtsText(parts)` — project a message's structured parts to a
  *      single searchable string. `lcd_messages` has NO content column (message
  *      text lives in `lcd_message_parts.tool_input`/`tool_output` + text-part
  *      JSON), so the store populates the CONTENTLESS `lcd_messages_fts` table on
- *      append with this rendering (PATTERNS gap #1).
+ *      append with this rendering.
  *   2. `searchLcdImpl(db, conversationId, query, opts)` — the FTS5-MATCH-with-
  *      LIKE-fallback branch. It probes FTS5 availability ONCE per db (a host
  *      whose better-sqlite3 lacks compiled FTS5 has no `lcd_*_fts` tables); when
  *      available it runs the BM25 MATCH queries (the in-tree recall-FTS query
  *      shape), when not it degrades to a bounded LIKE scan with `rank` undefined
- *      — NEVER hard-failing (LOSSLESS-CLAW §4 / DAG-REDESIGN §2.2).
+ *      — NEVER hard-failing.
  *
  * The `query` arrives PRE-SANITIZED (the tool runs the FTS5 query sanitizer from
  * @comis/skills before calling the port — @comis/memory cannot import it,
- * boundary cut; PATTERNS gap #2). All SQL is static with bound parameters — no
- * interpolated identifiers (T-131-02-01). Every query is scoped by
- * `conversation_id` (T-131-02-02). This file reads ONLY the `lcd_*_fts` tables,
- * NEVER the cross-session recall index (the E2/I2 boundary).
+ * boundary cut). All SQL is static with bound parameters — no
+ * interpolated identifiers. Every query is scoped by
+ * `conversation_id`. This file reads ONLY the `lcd_*_fts` tables,
+ * NEVER the cross-session recall index.
  *
  * The store is infra-free (AGENTS.md §2.4 — no logger): a degraded read returns
  * fewer/no hits silently by design.
@@ -46,7 +46,7 @@ export declare function renderMessageFtsText(parts: LcdMessagePart[]): string;
  * a `no such module: fts5` (uncompiled) OR `no such table` (DDL guarded off /
  * base-tables-only db) verdict is `false`. Memoized per db.
  *
- * Exported (WR-03) so the lcd-store append-path populate can GATE its
+ * Exported so the lcd-store append-path populate can GATE its
  * contentless-FTS insert on this verdict — turning the expected "FTS5 absent"
  * case into a clean conditional skip rather than an exception swallowed by an
  * over-broad bare `catch {}`, so the narrowed remaining catch covers only a
@@ -58,44 +58,45 @@ export declare function isFtsAvailable(db: Database.Database): boolean;
  * Probe whether this db has the LCD trigram twins (and thus the `trigram`
  * tokenizer compiled). Runs a trivial prepared MATCH against
  * `lcd_messages_fts_tri`; a `no such module`/`no such table` verdict is `false`
- * and the non-Latin query degrades to the bounded scan floor (Pitfall 11). A
+ * and the non-Latin query degrades to the bounded scan floor. A
  * SEPARATE WeakMap from `isFtsAvailable` — the two are independent degradation
  * axes (FTS5 present, trigram absent is a real host shape). Memoized per db; the
- * verdict GCs with the connection (mirrors isFtsAvailable, lcd-fts.ts:101-120).
+ * verdict GCs with the connection (mirrors isFtsAvailable).
  *
- * Exported (WR-03) so a write-path twin populate can gate on it, turning the
+ * Exported so a write-path twin populate can gate on it, turning the
  * expected "trigram absent" case into a clean conditional skip rather than an
  * exception. The literal probe token is bound (no interpolated identifiers).
  */
 export declare function isTriAvailable(db: Database.Database): boolean;
 /**
  * Full-text search over THIS (conversation, agent)'s lossless store with
- * SCRIPT-AWARE routing (FTS-01). The `query` MUST already be sanitized by the
- * caller. Returns at most `opts.limit` hits across the requested `opts.scope`. R4
- * (132-03): scoped by `conversationId` AND `agentId` on EVERY lane — the word FTS
+ * SCRIPT-AWARE routing. The `query` MUST already be sanitized by the
+ * caller. Returns at most `opts.limit` hits across the requested `opts.scope`.
+ * Scoped by `conversationId` AND `agentId` on EVERY lane — the word FTS
  * path, the LIKE fallback, the trigram twins, AND both scan-floor branches — so a
- * different agent sharing the conversation never recovers another agent's hits
- * (WR-02, Pitfall 3); the conversation_id prefix carries the tenant boundary.
+ * different agent sharing the conversation never recovers another agent's hits;
+ * the conversation_id prefix carries the tenant boundary.
  * Never throws (degrades to fewer/no hits).
  *
- * Routing (the 180-01 router decides the lane; `opts.scope` gates branches WITHIN
- * each lane exactly as the word lane does today):
+ * Routing (the query router decides the lane; `opts.scope` gates branches WITHIN
+ * each lane exactly as the word lane does):
  *   - "word" (all-Latin OR a phrase-less zero-token query): the ORIGINAL `query`
- *     string against the existing word FTS (or its LIKE floor) — I1 byte-identical.
- *   - "tri"  (has a non-Latin token, twins present): the 180-01 `route.match`
+ *     string against the existing word FTS (or its LIKE floor) — byte-identical
+ *     to a plain word-lane search.
+ *   - "tri"  (has a non-Latin token, twins present): the router's `route.match`
  *     MATCH against the trigram twins SELECTED BY scope. The query side imports the
- *     SAME `normalizeForSearch`/`routeSearchQuery` symbols the index side uses (the
- *     I7 symmetry closes here — query מלך finds stored מלכים).
+ *     SAME `normalizeForSearch`/`routeSearchQuery` symbols the index side uses, so
+ *     the query and index fold identically — query מלך finds stored מלכים.
  *   - "scan" (all tokens below the trigram floor, OR a non-Latin query on a
  *     trigram-ABSENT host): the bounded normalized-scan floor over `route.scanTokens`.
  *
- * Returns an {@link LcdSearchResult} (OBS-01): `lane` names the serving lane;
+ * Returns an {@link LcdSearchResult}: `lane` names the serving lane;
  * `matchErrored` is true iff a MATCH threw and degraded to [] (an errored
  * zero-result is NOT a lane gap — signal purity); `scriptZeroHit` is the dominant
  * non-Latin {@link ScriptClass} when the search ran CLEANLY and returned zero hits;
  * `cjkZeroHit` is the derived `scriptZeroHit === "cjk"` boolean; `scanCapped` flags a
- * scan floor that hit its row cap. Content-free (enums/booleans, never query text —
- * I8). @comis/memory has no logger (AGENTS.md §2.4); the caller's logging boundary
+ * scan floor that hit its row cap. Content-free (enums/booleans, never query text).
+ * @comis/memory has no logger (AGENTS.md §2.4); the caller's logging boundary
  * (skills/agent) emits the `script_zero_hit` event when `scriptZeroHit` is set.
  */
 export declare function searchLcdImpl(db: Database.Database, conversationId: string, agentId: string, query: string, opts: {

package/node_modules/@comis/memory/dist/lcd-fts.js

@@ -1,28 +1,28 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * FTS5 search helper for the LCD (Lossless Context DAG) lossless store (Phase
- * 131, E1 `ctx_search`). Extracted from `lcd-store.ts` so the adapter stays
- * under the 800-line file-size cap (Pitfall 6).
+ * FTS5 search helper for the LCD (Lossless Context DAG) lossless store — the
+ * `ctx_search` surface. Extracted from `lcd-store.ts` so the adapter stays
+ * under the 800-line file-size cap.
  *
  * Two responsibilities:
  *   1. `renderMessageFtsText(parts)` — project a message's structured parts to a
  *      single searchable string. `lcd_messages` has NO content column (message
  *      text lives in `lcd_message_parts.tool_input`/`tool_output` + text-part
  *      JSON), so the store populates the CONTENTLESS `lcd_messages_fts` table on
- *      append with this rendering (PATTERNS gap #1).
+ *      append with this rendering.
  *   2. `searchLcdImpl(db, conversationId, query, opts)` — the FTS5-MATCH-with-
  *      LIKE-fallback branch. It probes FTS5 availability ONCE per db (a host
  *      whose better-sqlite3 lacks compiled FTS5 has no `lcd_*_fts` tables); when
  *      available it runs the BM25 MATCH queries (the in-tree recall-FTS query
  *      shape), when not it degrades to a bounded LIKE scan with `rank` undefined
- *      — NEVER hard-failing (LOSSLESS-CLAW §4 / DAG-REDESIGN §2.2).
+ *      — NEVER hard-failing.
  *
  * The `query` arrives PRE-SANITIZED (the tool runs the FTS5 query sanitizer from
  * @comis/skills before calling the port — @comis/memory cannot import it,
- * boundary cut; PATTERNS gap #2). All SQL is static with bound parameters — no
- * interpolated identifiers (T-131-02-01). Every query is scoped by
- * `conversation_id` (T-131-02-02). This file reads ONLY the `lcd_*_fts` tables,
- * NEVER the cross-session recall index (the E2/I2 boundary).
+ * boundary cut). All SQL is static with bound parameters — no
+ * interpolated identifiers. Every query is scoped by
+ * `conversation_id`. This file reads ONLY the `lcd_*_fts` tables,
+ * NEVER the cross-session recall index.
  *
  * The store is infra-free (AGENTS.md §2.4 — no logger): a degraded read returns
  * fewer/no hits silently by design.
@@ -33,16 +33,16 @@ import { routeSearchQuery, normalizeForSearch, dominantScript } from "@comis/cor
 import { createRowMapper } from "./row-mapper.js";
 import { LcdSearchHitRowSchema, LcdLikeHitRowSchema } from "./row-schemas.js";
 /**
- * FTS-01: rows examined per scan-floor BRANCH before the floor reports
+ * Rows examined per scan-floor BRANCH before the floor reports
  * `scanCapped` and stops (DoS bound on a normalized scan over unbounded
- * conversation history — T-180-05-04). The design cap is ~2,000 rows per branch;
+ * conversation history). The design cap is ~2,000 rows per branch;
  * `.iterate()` gives an early exit at `limit` hits so a matching query rarely
  * reaches it. Honest degradation: the cap is surfaced to the model as scanCapped,
  * never silently swallowed.
  */
 const SCAN_ROW_CAP = 2000;
 const lcdSearchHitMapper = createRowMapper(LcdSearchHitRowSchema);
-// WR-02: the LIKE-fallback rows carry no `rank` column (no ranking) but MUST go
+// The LIKE-fallback rows carry no `rank` column (no ranking) but MUST go
 // through the SAME per-row validate+skip discipline as the MATCH path so a
 // drifted/corrupt row is skipped, never surfaced with an undefined snippet/refId.
 const lcdLikeHitMapper = createRowMapper(LcdLikeHitRowSchema);
@@ -53,13 +53,13 @@ const lcdLikeHitMapper = createRowMapper(LcdLikeHitRowSchema);
  */
 const ftsAvailabilityCache = new WeakMap();
 /**
- * Memoized TRIGRAM-twin-availability verdict per Database handle (FTS-01). The
+ * Memoized TRIGRAM-twin-availability verdict per Database handle. The
  * trigram twins are a separate degradation axis from the word-lane FTS: a host
  * can have FTS5 compiled but lack the `trigram` tokenizer (the twin CREATE throws
  * — see schema-trigram.ts), OR run on a partial-schema/old db whose twins were
  * never created. Probing once per db avoids re-running the throwing MATCH on
  * every search; the WeakMap lets the verdict GC with the connection. Mirrors
- * `isFtsAvailable` exactly (lcd-fts.ts:101-120).
+ * `isFtsAvailable` exactly.
  */
 const triAvailabilityCache = new WeakMap();
 /**
@@ -106,7 +106,7 @@ function safeStringify(value) {
  * a `no such module: fts5` (uncompiled) OR `no such table` (DDL guarded off /
  * base-tables-only db) verdict is `false`. Memoized per db.
  *
- * Exported (WR-03) so the lcd-store append-path populate can GATE its
+ * Exported so the lcd-store append-path populate can GATE its
  * contentless-FTS insert on this verdict — turning the expected "FTS5 absent"
  * case into a clean conditional skip rather than an exception swallowed by an
  * over-broad bare `catch {}`, so the narrowed remaining catch covers only a
@@ -137,12 +137,12 @@ export function isFtsAvailable(db) {
  * Probe whether this db has the LCD trigram twins (and thus the `trigram`
  * tokenizer compiled). Runs a trivial prepared MATCH against
  * `lcd_messages_fts_tri`; a `no such module`/`no such table` verdict is `false`
- * and the non-Latin query degrades to the bounded scan floor (Pitfall 11). A
+ * and the non-Latin query degrades to the bounded scan floor. A
  * SEPARATE WeakMap from `isFtsAvailable` — the two are independent degradation
  * axes (FTS5 present, trigram absent is a real host shape). Memoized per db; the
- * verdict GCs with the connection (mirrors isFtsAvailable, lcd-fts.ts:101-120).
+ * verdict GCs with the connection (mirrors isFtsAvailable).
  *
- * Exported (WR-03) so a write-path twin populate can gate on it, turning the
+ * Exported so a write-path twin populate can gate on it, turning the
  * expected "trigram absent" case into a clean conditional skip rather than an
  * exception. The literal probe token is bound (no interpolated identifiers).
  */
@@ -164,32 +164,33 @@ export function isTriAvailable(db) {
 }
 /**
  * Full-text search over THIS (conversation, agent)'s lossless store with
- * SCRIPT-AWARE routing (FTS-01). The `query` MUST already be sanitized by the
- * caller. Returns at most `opts.limit` hits across the requested `opts.scope`. R4
- * (132-03): scoped by `conversationId` AND `agentId` on EVERY lane — the word FTS
+ * SCRIPT-AWARE routing. The `query` MUST already be sanitized by the
+ * caller. Returns at most `opts.limit` hits across the requested `opts.scope`.
+ * Scoped by `conversationId` AND `agentId` on EVERY lane — the word FTS
  * path, the LIKE fallback, the trigram twins, AND both scan-floor branches — so a
- * different agent sharing the conversation never recovers another agent's hits
- * (WR-02, Pitfall 3); the conversation_id prefix carries the tenant boundary.
+ * different agent sharing the conversation never recovers another agent's hits;
+ * the conversation_id prefix carries the tenant boundary.
  * Never throws (degrades to fewer/no hits).
  *
- * Routing (the 180-01 router decides the lane; `opts.scope` gates branches WITHIN
- * each lane exactly as the word lane does today):
+ * Routing (the query router decides the lane; `opts.scope` gates branches WITHIN
+ * each lane exactly as the word lane does):
  *   - "word" (all-Latin OR a phrase-less zero-token query): the ORIGINAL `query`
- *     string against the existing word FTS (or its LIKE floor) — I1 byte-identical.
- *   - "tri"  (has a non-Latin token, twins present): the 180-01 `route.match`
+ *     string against the existing word FTS (or its LIKE floor) — byte-identical
+ *     to a plain word-lane search.
+ *   - "tri"  (has a non-Latin token, twins present): the router's `route.match`
  *     MATCH against the trigram twins SELECTED BY scope. The query side imports the
- *     SAME `normalizeForSearch`/`routeSearchQuery` symbols the index side uses (the
- *     I7 symmetry closes here — query מלך finds stored מלכים).
+ *     SAME `normalizeForSearch`/`routeSearchQuery` symbols the index side uses, so
+ *     the query and index fold identically — query מלך finds stored מלכים.
  *   - "scan" (all tokens below the trigram floor, OR a non-Latin query on a
  *     trigram-ABSENT host): the bounded normalized-scan floor over `route.scanTokens`.
  *
- * Returns an {@link LcdSearchResult} (OBS-01): `lane` names the serving lane;
+ * Returns an {@link LcdSearchResult}: `lane` names the serving lane;
  * `matchErrored` is true iff a MATCH threw and degraded to [] (an errored
  * zero-result is NOT a lane gap — signal purity); `scriptZeroHit` is the dominant
  * non-Latin {@link ScriptClass} when the search ran CLEANLY and returned zero hits;
  * `cjkZeroHit` is the derived `scriptZeroHit === "cjk"` boolean; `scanCapped` flags a
- * scan floor that hit its row cap. Content-free (enums/booleans, never query text —
- * I8). @comis/memory has no logger (AGENTS.md §2.4); the caller's logging boundary
+ * scan floor that hit its row cap. Content-free (enums/booleans, never query text).
+ * @comis/memory has no logger (AGENTS.md §2.4); the caller's logging boundary
  * (skills/agent) emits the `script_zero_hit` event when `scriptZeroHit` is set.
  */
 export function searchLcdImpl(db, conversationId, agentId, query, opts) {
@@ -197,7 +198,7 @@ export function searchLcdImpl(db, conversationId, agentId, query, opts) {
     const limit = opts.limit;
     if (limit <= 0)
         return { hits: [], cjkZeroHit: false, lane: "word", matchErrored: false };
-    // The 180-01 router (LCD implicit-AND semantics): all-Latin → "word" (keep the
+    // The query router (LCD implicit-AND semantics): all-Latin → "word" (keep the
     // ORIGINAL string), any non-Latin token → "tri", all-short → "scan".
     const route = routeSearchQuery(query, { join: "and" });
     let lane;
@@ -210,15 +211,15 @@ export function searchLcdImpl(db, conversationId, agentId, query, opts) {
             : searchViaLike(db, conversationId, agentId, query, scope, limit);
     }
     else if (route.lane === "tri" && route.match !== undefined && isTriAvailable(db)) {
-        // The trigram twins (route.match comes ONLY from the 180-01 builder — quoted
-        // terms, operator allowlist, dangling-operator sweep; T-180-05-02).
+        // The trigram twins (route.match comes ONLY from the query builder — quoted
+        // terms, operator allowlist, dangling-operator sweep).
         lane = "tri";
         result = searchTrigram(db, conversationId, agentId, route.match, scope, limit);
     }
     else {
         // Either the router chose "scan" (all tokens below the trigram floor), OR the
-        // host lacks the trigram tokenizer (tri route but isTriAvailable false —
-        // Pitfall 11). Both degrade to the bounded normalized scan floor over the
+        // host lacks the trigram tokenizer (tri route but isTriAvailable false).
+        // Both degrade to the bounded normalized scan floor over the
         // query's non-operator tokens.
         lane = "scan";
         const scanTokens = route.scanTokens ??
@@ -227,8 +228,8 @@ export function searchLcdImpl(db, conversationId, agentId, query, opts) {
             deriveScanTokens(query);
         result = searchViaScan(db, conversationId, agentId, scanTokens, scope, limit);
     }
-    // Result assembly (the OBS-01 seam). dominantScript returns "latin" for
-    // empty/all-neutral/Latin text (script-classes.ts:255-287, verified), so the
+    // Result assembly. dominantScript returns "latin" for
+    // empty/all-neutral/Latin text, so the
     // `script !== "latin"` guard keeps neutral-only and Latin queries silent.
     const matchErrored = result.errored;
     const script = dominantScript(query);
@@ -276,7 +277,7 @@ function searchViaFts(db, conversationId, agentId, query, scope, limit) {
         }
         case "both": {
             // Merge the two tables by WITHIN-TABLE rank POSITION, not by raw BM25
-            // (WR-03). BM25 `rank` is corpus-relative — only comparable inside ONE
+            // score. BM25 `rank` is corpus-relative — only comparable inside ONE
             // FTS index, never across two virtual tables with different document
             // populations + average lengths. Each table's hits already arrive
             // best-first (the per-table `ORDER BY rank`), so a fair round-robin —
@@ -298,8 +299,8 @@ function searchViaFts(db, conversationId, agentId, query, scope, limit) {
     }
 }
 /**
- * Round-robin merge of two per-table-ranked hit lists for `scope="both"`
- * (WR-03). Each input is already best-first within its own table. We take the
+ * Round-robin merge of two per-table-ranked hit lists for `scope="both"`.
+ * Each input is already best-first within its own table. We take the
  * best from each in turn (summary, message, summary, message, …) so neither
  * table is starved when the merged set is truncated to `limit`, draining
  * whichever list still has hits once the other is exhausted. This compares only
@@ -322,8 +323,8 @@ function interleaveByRank(summaries, messages, limit) {
     return out;
 }
 function ftsSummaryHits(db, conversationId, agentId, query, limit) {
-    // R4: + AND agent_id = ? (the vtable carries agent_id UNINDEXED) so a different
-    // agent's summary hits never leak within a shared conversation (WR-02).
+    // + AND agent_id = ? (the vtable carries agent_id UNINDEXED) so a different
+    // agent's summary hits never leak within a shared conversation.
     const stmt = db.prepare(`
     SELECT summary_id AS ref_id, content AS snippet, rank
     FROM lcd_summaries_fts
@@ -335,8 +336,8 @@ function ftsSummaryHits(db, conversationId, agentId, query, limit) {
     return { hits: mapFtsRows(rows, "summary"), errored };
 }
 function ftsMessageHits(db, conversationId, agentId, query, limit) {
-    // R4: + AND agent_id = ? (the vtable carries agent_id UNINDEXED; the adapter
-    // populates it on append) so cross-agent message hits never leak (WR-02).
+    // + AND agent_id = ? (the vtable carries agent_id UNINDEXED; the adapter
+    // populates it on append) so cross-agent message hits never leak.
     const stmt = db.prepare(`
     SELECT message_id AS ref_id, content AS snippet, rank
     FROM lcd_messages_fts
@@ -348,15 +349,15 @@ function ftsMessageHits(db, conversationId, agentId, query, limit) {
     return { hits: mapFtsRows(rows, "message"), errored };
 }
 /**
- * Trigram-twin MATCH lane (FTS-01) — the non-Latin analog of `searchViaFts`.
- * `match` is the 180-01 builder's complete MATCH string (quoted normalized terms
- * + operator allowlist + dangling-operator sweep — T-180-05-02). `opts.scope`
+ * Trigram-twin MATCH lane — the non-Latin analog of `searchViaFts`.
+ * `match` is the query builder's complete MATCH string (quoted normalized terms
+ * + operator allowlist + dangling-operator sweep). `opts.scope`
  * selects which twin(s) to query EXACTLY as `searchViaFts` selects its branches:
  * "messages" → ONLY lcd_messages_fts_tri (ONE bounded MATCH — the relevance-
  * eviction hot path takes this branch, no interleave, no summary query),
  * "summaries" → ONLY lcd_summaries_fts_tri, "both" → both twins merged via
- * `interleaveByRank` VERBATIM (the same WR-03 within-table round-robin the word
- * lane uses). R4: every twin query is `MATCH ? AND conversation_id = ? AND
+ * `interleaveByRank` VERBATIM (the same within-table round-robin the word
+ * lane uses). Every twin query is `MATCH ? AND conversation_id = ? AND
  * agent_id = ?` (the twin carries agent_id UNINDEXED — schema-trigram.ts).
  */
 function searchTrigram(db, conversationId, agentId, match, scope, limit) {
@@ -384,11 +385,11 @@ function searchTrigram(db, conversationId, agentId, match, scope, limit) {
     }
 }
 function triSummaryHits(db, conversationId, agentId, match, limit) {
-    // R4: + AND agent_id = ? (the twin carries agent_id UNINDEXED) so a different
-    // agent's summary hits never leak within a shared conversation (WR-02). The
+    // + AND agent_id = ? (the twin carries agent_id UNINDEXED) so a different
+    // agent's summary hits never leak within a shared conversation. The
     // `prepare` is INSIDE the guard: when the cached isTriAvailable verdict is stale
     // (the twin table was dropped after the probe), `prepare` itself throws — that
-    // must surface as matchErrored, not an uncaught exception (OBS-01 purity).
+    // must surface as matchErrored, not an uncaught exception (signal purity).
     const { rows, errored } = safeAllReporting(() => db
         .prepare(`
         SELECT summary_id AS ref_id, content AS snippet, rank
@@ -401,8 +402,8 @@ function triSummaryHits(db, conversationId, agentId, match, limit) {
     return { hits: mapFtsRows(rows, "summary"), errored };
 }
 function triMessageHits(db, conversationId, agentId, match, limit) {
-    // R4: + AND agent_id = ? (the twin carries agent_id UNINDEXED) so cross-agent
-    // message hits never leak within a shared conversation (WR-02). `prepare` is
+    // + AND agent_id = ? (the twin carries agent_id UNINDEXED) so cross-agent
+    // message hits never leak within a shared conversation. `prepare` is
     // inside the guard (see triSummaryHits) — a stale-availability dropped table
     // throws at prepare and must report errored, never throw uncaught.
     const { rows, errored } = safeAllReporting(() => db
@@ -417,11 +418,11 @@ function triMessageHits(db, conversationId, agentId, match, limit) {
     return { hits: mapFtsRows(rows, "message"), errored };
 }
 /**
- * Map FTS rows through the strict row schema, degrading PER ROW (WR-02), not
+ * Map FTS rows through the strict row schema, degrading PER ROW, not
  * per result-set. `parseRows` returns err on the FIRST malformed row and
  * discards every already-validated sibling — so a single corrupt/drifted FTS
  * hit would silently null ALL hits for the scope (the "one bad row drops good
- * siblings" failure WR-02 was introduced to prevent). Mirror every sibling LCD
+ * siblings" failure this per-row discipline prevents). Mirror every sibling LCD
  * read (`getMessages`/`getSummaries`/`getSummaryChildren`/`getSummaryMessages`,
  * lcd-store.ts): validate each row with `parseOptionalRow` and skip ONLY the bad
  * row, keeping its good siblings. Ordering is preserved (we iterate the ORDER BY
@@ -434,7 +435,7 @@ function mapFtsRows(rawRows, kind) {
     for (const raw of rawRows) {
         const parsed = lcdSearchHitMapper.parseOptionalRow(raw);
         if (!parsed.ok || !parsed.value)
-            continue; // skip only the bad row (WR-02)
+            continue; // skip only the bad row
         out.push({ kind, refId: parsed.value.ref_id, snippet: parsed.value.snippet, rank: parsed.value.rank });
     }
     return out;
@@ -444,9 +445,9 @@ function mapFtsRows(rawRows, kind) {
  * parts' JSON text columns (the same surfaces `renderMessageFtsText` indexes),
  * scoped by (conversation, agent). `rank` is undefined — the contract's
  * no-ranking marker. Bound `%term%` param (LIKE wildcards escaped); static SQL.
- * R4 (132-03, Pitfall 3): the fallback MUST filter agent_id too — `AND agent_id =
+ * The fallback MUST filter agent_id too — `AND agent_id =
  * ?` (summaries) / `AND m.agent_id = ?` (messages JOIN) — not just the FTS path,
- * else a different agent's hits leak when FTS5 is uncompiled (WR-02).
+ * else a different agent's hits leak when FTS5 is uncompiled.
  */
 function searchViaLike(db, conversationId, agentId, query, scope, limit) {
     const like = `%${escapeLike(query)}%`;
@@ -463,7 +464,7 @@ function searchViaLike(db, conversationId, agentId, query, scope, limit) {
         const res = safeAllReporting(() => stmt.all(conversationId, agentId, like, limit));
         errored = errored || res.errored;
         for (const raw of res.rows) {
-            // WR-02: per-row validate+skip (mirror mapFtsRows / every other LCD read) —
+            // Per-row validate+skip (mirror mapFtsRows / every other LCD read) —
             // a corrupt/drifted row is skipped, never pushed with an undefined snippet.
             const parsed = lcdLikeHitMapper.parseOptionalRow(raw);
             if (!parsed.ok || !parsed.value)
@@ -475,7 +476,7 @@ function searchViaLike(db, conversationId, agentId, query, scope, limit) {
         // Message text is JSON across part columns — LIKE over the rendered-equivalent
         // columns (tool_input/tool_output/metadata) of the message's parts. DISTINCT
         // message id; snippet is the matched part's metadata (UNTRUSTED — the tool
-        // taint-wraps before re-entry). R4: + AND m.agent_id = ? (Pitfall 3).
+        // taint-wraps before re-entry). + AND m.agent_id = ? for agent isolation.
         const stmt = db.prepare(`
       SELECT m.id AS ref_id, p.metadata AS snippet
       FROM lcd_messages m
@@ -493,7 +494,7 @@ function searchViaLike(db, conversationId, agentId, query, scope, limit) {
         errored = errored || res.errored;
         const seen = new Set();
         for (const raw of res.rows) {
-            // WR-02: per-row validate+skip BEFORE the de-dup so a corrupt row (e.g. a
+            // Per-row validate+skip BEFORE the de-dup so a corrupt row (e.g. a
             // NULL projected id) is dropped rather than seeding `seen`/a hit with an
             // undefined refId. Mirrors mapFtsRows + every other LCD read.
             const parsed = lcdLikeHitMapper.parseOptionalRow(raw);
@@ -513,18 +514,18 @@ function escapeLike(value) {
     return value.replace(/[\\%_]/g, (ch) => `\\${ch}`);
 }
 /**
- * The bounded NORMALIZED-SCAN floor (FTS-01) — the lane for an all-short or
+ * The bounded NORMALIZED-SCAN floor — the lane for an all-short or
  * trigram-absent non-Latin query. Mirrors `searchViaLike`'s two-branch scope
- * structure (R4 on both branches, DISTINCT-message dedupe via the GROUP BY) but:
+ * structure (agent-scoped on both branches, DISTINCT-message dedupe via the GROUP BY) but:
  *   - reads NEWEST-first (`ORDER BY created_at DESC` / `m.seq DESC`),
  *   - uses an `.iterate()` cursor with an early exit once `limit` hits accrue,
- *   - examines at most {@link SCAN_ROW_CAP} rows PER BRANCH (the DoS bound,
- *     T-180-05-04) and sets `scanCapped` when a branch exhausts that cap with rows
+ *   - examines at most {@link SCAN_ROW_CAP} rows PER BRANCH (the DoS bound)
+ *     and sets `scanCapped` when a branch exhausts that cap with rows
  *     still unexamined,
  *   - matches with `normalizeForSearch(haystack).includes(token)` for EVERY token
  *     in `scanTokens` (AND semantics — the same column text searchViaLike LIKEs),
- *     the tokens being ALREADY normalized by the 180-01 router / `deriveScanTokens`.
- * Symmetric folding (I7): both sides pass through the SAME `normalizeForSearch`.
+ *     the tokens being ALREADY normalized by the query router / `deriveScanTokens`.
+ * Symmetric folding: both sides pass through the SAME `normalizeForSearch`.
  * Never throws — `safeAllReporting`-equivalent guarding via the iterate try/catch.
  */
 function searchViaScan(db, conversationId, agentId, scanTokens, scope, limit) {
@@ -545,7 +546,7 @@ function searchViaScan(db, conversationId, agentId, scanTokens, scope, limit) {
     // the cap (cursor exhausts naturally → not capped, no false alarm).
     const FETCH = SCAN_ROW_CAP + 1;
     if (scope === "summaries" || scope === "both") {
-        // R4: conversation_id AND agent_id (the base table carries both).
+        // Scoped by conversation_id AND agent_id (the base table carries both).
         const stmt = db.prepare(`
       SELECT summary_id AS ref_id, content AS snippet
       FROM lcd_summaries
@@ -562,7 +563,7 @@ function searchViaScan(db, conversationId, agentId, scanTokens, scope, limit) {
                     break;
                 }
                 examined += 1;
-                const parsed = lcdLikeHitMapper.parseOptionalRow(raw); // WR-02 per-row validate+skip
+                const parsed = lcdLikeHitMapper.parseOptionalRow(raw); // per-row validate+skip
                 if (!parsed.ok || !parsed.value)
                     continue;
                 if (!matchesAll(parsed.value.snippet))
@@ -581,7 +582,7 @@ function searchViaScan(db, conversationId, agentId, scanTokens, scope, limit) {
         // tool_output/metadata columns searchViaLike scans), newest-first, R4-scoped.
         // GROUP BY collapses to one row per message (the DISTINCT-message contract).
         //
-        // WR-03 (egress parity): the HAYSTACK stays the full multi-part concat —
+        // Egress parity: the HAYSTACK stays the full multi-part concat —
         // matchesAll must see every part's text. But the SNIPPET is bounded to ONE
         // representative part (the first by ordinal), matching searchViaLike's
         // single-part snippet and the FTS lane's single content column. The old
@@ -609,7 +610,7 @@ function searchViaScan(db, conversationId, agentId, scanTokens, scope, limit) {
                 }
                 examined += 1;
                 const row = raw;
-                // WR-02: a corrupt/drifted row (non-string id/snippet) is skipped.
+                // A corrupt/drifted row (non-string id/snippet) is skipped.
                 if (typeof row.ref_id !== "string")
                     continue;
                 const haystack = typeof row.haystack === "string" ? row.haystack : "";
@@ -629,12 +630,12 @@ function searchViaScan(db, conversationId, agentId, scanTokens, scope, limit) {
 }
 /**
  * Run a `.all()` that may throw (a missing table on a degraded host, or an FTS5
- * syntax error) and REPORT whether it threw (OBS-01 signal purity, Pitfall 9).
+ * syntax error) and REPORT whether it threw (signal purity).
  * The rows-on-error are still `[]` (the word-lane behavior is byte-identical),
  * but the error FACT is now threaded to the caller so `scriptZeroHit` can be
  * suppressed on a swallowed error: an errored zero-result is NOT a lane gap.
  * Memory stays logger-free (AGENTS.md §2.4) — the WARN with hint+errorKind for a
- * residual MATCH error lives at the TOOL boundary (plan 180-08), not here.
+ * residual MATCH error lives at the TOOL boundary, not here.
  */
 function safeAllReporting(fn) {
     try {

package/node_modules/@comis/memory/dist/lcd-ingest-serializer.d.ts

@@ -1,12 +1,12 @@
 /**
- * Per-conversation single-flight ingest serializer (Plan 132-04, R3).
+ * Per-conversation single-flight ingest serializer.
  *
- * C4 makes the afterTurn leaf + condense compaction passes DEFERRED — they run
- * detached off the turn so afterTurn returns before the compaction's store write
+ * The afterTurn leaf + condense compaction passes run DEFERRED — detached off the
+ * turn, so afterTurn returns before the compaction's store write
  * completes. That introduces a SECOND writer to a conversation's lossless store
  * (the deferred compaction) which can race the NEXT turn's synchronous ingest on
  * the `(conversation_id, agent_id, tenant_id, seq)` unique index and the
- * `lcd_context_items` ordinals (Pitfall 2). This serializer is the integrity
+ * `lcd_context_items` ordinals. This serializer is the integrity
  * boundary between them: BOTH the live ingest write AND the deferred compaction
  * write enqueue onto a per-conversation `PQueue({ concurrency: 1 })`, so on one
  * conversation they are strictly one-at-a-time and can never interleave.
@@ -21,7 +21,7 @@
  * AGENTS.md §2.4 forbids importing the infra logger directly. This module ONLY
  * orders writes — it does NOT log. The serialized-ingest-wait observability
  * (WARN + `context:dag_degraded`) is added agent-side where the injected
- * `ComisLogger` exists (Plan 132-04 Task 3); the serializer stays a silent
+ * `ComisLogger` exists; the serializer stays a silent
  * ordering seam.
  *
  * `p-queue` is a `@comis/memory` dependency (the agent has none — the agent
@@ -54,6 +54,6 @@ export interface IngestSerializer {
  * `concurrency: 1` (single-flight). Queues are lazily created on first use for a
  * conversation and retained for the process lifetime (the conversation set is
  * bounded by the active sessions; an unbounded-growth eviction policy is a
- * deferred Phase-133/O1 concern, not a correctness issue here).
+ * deferred concern, not a correctness issue here).
  */
 export declare function createIngestSerializer(): IngestSerializer;

package/node_modules/@comis/memory/dist/lcd-ingest-serializer.js

@@ -1,13 +1,13 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * Per-conversation single-flight ingest serializer (Plan 132-04, R3).
+ * Per-conversation single-flight ingest serializer.
  *
- * C4 makes the afterTurn leaf + condense compaction passes DEFERRED — they run
- * detached off the turn so afterTurn returns before the compaction's store write
+ * The afterTurn leaf + condense compaction passes run DEFERRED — detached off the
+ * turn, so afterTurn returns before the compaction's store write
  * completes. That introduces a SECOND writer to a conversation's lossless store
  * (the deferred compaction) which can race the NEXT turn's synchronous ingest on
  * the `(conversation_id, agent_id, tenant_id, seq)` unique index and the
- * `lcd_context_items` ordinals (Pitfall 2). This serializer is the integrity
+ * `lcd_context_items` ordinals. This serializer is the integrity
  * boundary between them: BOTH the live ingest write AND the deferred compaction
  * write enqueue onto a per-conversation `PQueue({ concurrency: 1 })`, so on one
  * conversation they are strictly one-at-a-time and can never interleave.
@@ -22,7 +22,7 @@
  * AGENTS.md §2.4 forbids importing the infra logger directly. This module ONLY
  * orders writes — it does NOT log. The serialized-ingest-wait observability
  * (WARN + `context:dag_degraded`) is added agent-side where the injected
- * `ComisLogger` exists (Plan 132-04 Task 3); the serializer stays a silent
+ * `ComisLogger` exists; the serializer stays a silent
  * ordering seam.
  *
  * `p-queue` is a `@comis/memory` dependency (the agent has none — the agent
@@ -39,7 +39,7 @@ import PQueue from "p-queue";
  * `concurrency: 1` (single-flight). Queues are lazily created on first use for a
  * conversation and retained for the process lifetime (the conversation set is
  * bounded by the active sessions; an unbounded-growth eviction policy is a
- * deferred Phase-133/O1 concern, not a correctness issue here).
+ * deferred concern, not a correctness issue here).
  */
 export function createIngestSerializer() {
     // One single-flight queue per conversationId. Lazily created; never a single