comisai 1.0.44 → 1.0.46

package/node_modules/@comis/memory/dist/msteams-conversation-row-schema.js

@@ -0,0 +1,40 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Zod row schema for the `msteams_conversation_refs` table — the persisted
+ * conversation-id → routing-tuple map. SSOT for the file-internal
+ * `MsTeamsConversationRow` type in `msteams-conversation-store.ts`.
+ *
+ * Conventions (same as the other row schemas):
+ *   - `z.strictObject(...)` rejects extra columns, so a drift between the schema
+ *     and the `ensureMsTeamsConversationTable` DDL surfaces in the round-trip test.
+ *   - nullable → `z.X.nullable()` (`X | null`) — SQLite NULL ≠ undefined; the
+ *     store's `rowToRef` maps `?? undefined` at the domain boundary.
+ *   - INTEGER → `z.number()`; TEXT → `z.string()` (nullable TEXT → `.nullable()`).
+ *
+ * SECURITY — routing columns ONLY: `conversation_id`, `service_url`, `tenant_id`
+ * (routing, not credentials), `thread_id`, `updated_at_ms`. There is deliberately
+ * NO credential column and NO message-content column — the strictObject REJECTS
+ * one if the DDL ever adds it.
+ *
+ * Columns MUST match the `ensureMsTeamsConversationTable` DDL exactly.
+ *
+ * @module
+ */
+import { z } from "zod";
+/**
+ * Schema for the `msteams_conversation_refs` table.
+ * SSOT for the file-internal `MsTeamsConversationRow` type in
+ * msteams-conversation-store.ts. Columns MUST match the
+ * `ensureMsTeamsConversationTable` DDL exactly (strictObject).
+ */
+export const MsTeamsConversationRowSchema = z.strictObject({
+    // sha256(conversation_id) — the fixed-width PK.
+    key: z.string(),
+    conversation_id: z.string(),
+    service_url: z.string(),
+    tenant_id: z.string(),
+    // Thread root; NULL for a 1:1 or unthreaded chat. SQLite NULL ≠ undefined —
+    // rowToRef maps `?? undefined` at the domain boundary.
+    thread_id: z.string().nullable(),
+    updated_at_ms: z.number(),
+});

package/node_modules/@comis/memory/dist/msteams-conversation-store.d.ts

@@ -0,0 +1,45 @@
+/**
+ * createSqliteMsTeamsConversationStore — SQLite persistence for the conversation-id
+ * → routing-tuple map, implementing the `@comis/core`
+ * {@link MsTeamsConversationStorePort}.
+ *
+ * Factory-function pattern (modeled on `createSqliteOutwardSendLedger`): prepares
+ * fixed SQL statements once in the closure, returns a frozen
+ * `MsTeamsConversationStorePort`. Reads go through
+ * `createRowMapper(MsTeamsConversationRowSchema)` so a corrupt row degrades to a
+ * `Result.err`, never a throw — a single bad row cannot abort a proactive send
+ * resolve.
+ *
+ * WHY THIS STORE: a reply rides the inbound activity's own routing; a PROACTIVE
+ * send (cron, heartbeat, an unsolicited notice) has no inbound activity, so it must
+ * recover `{serviceUrl, tenantId, threadId}` from a durable map keyed by the
+ * conversation id. This store is that map, refreshed on every inbound activity so
+ * the freshest routing tuple is always on hand.
+ *
+ * KEY + BOUNDED GROWTH: `key = sha256(conversationId)` is the fixed-width PK.
+ * `capture` is an upsert (`ON CONFLICT(key) DO UPDATE`) that refreshes the routing
+ * tuple + `updated_at_ms`; it then runs a TTL prune (drop rows older than
+ * {@link TTL_MS}) and a cap eviction (keep the {@link CAP} most-recently-updated),
+ * so the table cannot grow unbounded no matter how many conversations are seen.
+ *
+ * SECURITY: the persisted columns carry ROUTING only (`service_url`, `tenant_id`,
+ * `conversation_id`, `thread_id`) — there is no credential column and no
+ * message-content column. A stored `service_url` stays untrusted at read: the send
+ * path re-validates it against the host allowlist before use.
+ *
+ * @module
+ */
+import type Database from "better-sqlite3";
+import { type MsTeamsConversationStorePort } from "@comis/core";
+/**
+ * Create a SQLite-backed `MsTeamsConversationStorePort`.
+ *
+ * Assumes `initSchema()` (which calls `ensureMsTeamsConversationTable`) has already
+ * been called — the `msteams_conversation_refs` table + its `updated_at_ms` index
+ * exist. Prepares fixed SQL once.
+ *
+ * @param db - An open better-sqlite3 Database instance
+ * @param nowMs - Optional injectable wall-clock (deterministic tests); defaults to systemNowMs. Used only for the TTL prune boundary.
+ * @returns MsTeamsConversationStorePort implementation (frozen)
+ */
+export declare function createSqliteMsTeamsConversationStore(db: Database.Database, nowMs?: () => number): MsTeamsConversationStorePort;

package/node_modules/@comis/memory/dist/msteams-conversation-store.js

@@ -0,0 +1,145 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * createSqliteMsTeamsConversationStore — SQLite persistence for the conversation-id
+ * → routing-tuple map, implementing the `@comis/core`
+ * {@link MsTeamsConversationStorePort}.
+ *
+ * Factory-function pattern (modeled on `createSqliteOutwardSendLedger`): prepares
+ * fixed SQL statements once in the closure, returns a frozen
+ * `MsTeamsConversationStorePort`. Reads go through
+ * `createRowMapper(MsTeamsConversationRowSchema)` so a corrupt row degrades to a
+ * `Result.err`, never a throw — a single bad row cannot abort a proactive send
+ * resolve.
+ *
+ * WHY THIS STORE: a reply rides the inbound activity's own routing; a PROACTIVE
+ * send (cron, heartbeat, an unsolicited notice) has no inbound activity, so it must
+ * recover `{serviceUrl, tenantId, threadId}` from a durable map keyed by the
+ * conversation id. This store is that map, refreshed on every inbound activity so
+ * the freshest routing tuple is always on hand.
+ *
+ * KEY + BOUNDED GROWTH: `key = sha256(conversationId)` is the fixed-width PK.
+ * `capture` is an upsert (`ON CONFLICT(key) DO UPDATE`) that refreshes the routing
+ * tuple + `updated_at_ms`; it then runs a TTL prune (drop rows older than
+ * {@link TTL_MS}) and a cap eviction (keep the {@link CAP} most-recently-updated),
+ * so the table cannot grow unbounded no matter how many conversations are seen.
+ *
+ * SECURITY: the persisted columns carry ROUTING only (`service_url`, `tenant_id`,
+ * `conversation_id`, `thread_id`) — there is no credential column and no
+ * message-content column. A stored `service_url` stays untrusted at read: the send
+ * path re-validates it against the host allowlist before use.
+ *
+ * @module
+ */
+import { createHash } from "node:crypto";
+import { ok, err } from "@comis/shared";
+import { systemNowMs, } from "@comis/core";
+import { createRowMapper } from "./row-mapper.js";
+import { MsTeamsConversationRowSchema, } from "./msteams-conversation-row-schema.js";
+// ---------------------------------------------------------------------------
+// Bounded-growth constants (internal — not config keys)
+// ---------------------------------------------------------------------------
+/**
+ * The hard row cap. On every capture the store keeps the {@link CAP}
+ * most-recently-updated rows and evicts the oldest, so the table is bounded
+ * regardless of how many distinct conversations are seen.
+ */
+const CAP = 1000;
+/**
+ * The reference time-to-live (ms). On every capture the store prunes rows whose
+ * `updated_at_ms` is older than now − {@link TTL_MS} (365 days), so a conversation
+ * that has gone silent for a year is dropped rather than kept forever.
+ */
+const TTL_MS = 365 * 24 * 60 * 60 * 1000;
+// ---------------------------------------------------------------------------
+// Row mapper (snake_case -> camelCase)
+// ---------------------------------------------------------------------------
+const conversationRowMapper = createRowMapper(MsTeamsConversationRowSchema);
+/**
+ * Map a validated DB row to the domain {@link ConversationReference}. The nullable
+ * `thread_id` maps `?? undefined` at the domain boundary (SQLite NULL ≠ undefined),
+ * so an unthreaded chat surfaces as "field absent" on the optional `threadId`.
+ */
+function rowToRef(row) {
+    return {
+        conversationId: row.conversation_id,
+        serviceUrl: row.service_url,
+        tenantId: row.tenant_id,
+        ...(row.thread_id !== null ? { threadId: row.thread_id } : {}),
+        updatedAt: row.updated_at_ms,
+    };
+}
+/** The fixed-width PK: sha256 hex of the conversation id. */
+function conversationKey(conversationId) {
+    return createHash("sha256").update(conversationId).digest("hex");
+}
+// ---------------------------------------------------------------------------
+// Factory
+// ---------------------------------------------------------------------------
+/**
+ * Create a SQLite-backed `MsTeamsConversationStorePort`.
+ *
+ * Assumes `initSchema()` (which calls `ensureMsTeamsConversationTable`) has already
+ * been called — the `msteams_conversation_refs` table + its `updated_at_ms` index
+ * exist. Prepares fixed SQL once.
+ *
+ * @param db - An open better-sqlite3 Database instance
+ * @param nowMs - Optional injectable wall-clock (deterministic tests); defaults to systemNowMs. Used only for the TTL prune boundary.
+ * @returns MsTeamsConversationStorePort implementation (frozen)
+ */
+export function createSqliteMsTeamsConversationStore(db, nowMs = systemNowMs) {
+    // --- Prepared statements ---
+    // Upsert: refresh the routing tuple + updated_at_ms for an existing
+    // conversation, insert it otherwise. The stored updated_at_ms is the reference's
+    // own timestamp (round-tripped by get), NOT nowMs.
+    const upsertStmt = db.prepare(`
+    INSERT INTO msteams_conversation_refs (
+      key, conversation_id, service_url, tenant_id, thread_id, updated_at_ms
+    ) VALUES (?, ?, ?, ?, ?, ?)
+    ON CONFLICT(key) DO UPDATE SET
+      service_url   = excluded.service_url,
+      tenant_id     = excluded.tenant_id,
+      thread_id     = excluded.thread_id,
+      updated_at_ms = excluded.updated_at_ms
+  `);
+    // TTL prune — drop everything older than now − TTL_MS.
+    const pruneStmt = db.prepare(`DELETE FROM msteams_conversation_refs WHERE updated_at_ms < ?`);
+    // Cap eviction — keep only the CAP most-recently-updated rows, delete the rest
+    // (the oldest by updated_at_ms).
+    const capEvictStmt = db.prepare(`
+    DELETE FROM msteams_conversation_refs
+    WHERE key NOT IN (
+      SELECT key FROM msteams_conversation_refs ORDER BY updated_at_ms DESC LIMIT ?
+    )
+  `);
+    const getStmt = db.prepare(`SELECT * FROM msteams_conversation_refs WHERE key = ?`);
+    // --- Store implementation ---
+    const store = {
+        capture(reference) {
+            try {
+                upsertStmt.run(conversationKey(reference.conversationId), reference.conversationId, reference.serviceUrl, reference.tenantId, reference.threadId ?? null, reference.updatedAt);
+                // Bound the table on every capture: prune expired rows, then cap growth.
+                pruneStmt.run(nowMs() - TTL_MS);
+                capEvictStmt.run(CAP);
+                return Promise.resolve(ok(undefined));
+            }
+            catch (e) {
+                return Promise.resolve(err(e instanceof Error ? e : new Error(String(e))));
+            }
+        },
+        get(conversationId) {
+            try {
+                const parsed = conversationRowMapper.parseOptionalRow(getStmt.get(conversationKey(conversationId)));
+                if (!parsed.ok) {
+                    return Promise.resolve(err(new Error(`Row validation failed: ${parsed.error.message}`)));
+                }
+                if (parsed.value === undefined)
+                    return Promise.resolve(ok(undefined));
+                return Promise.resolve(ok(rowToRef(parsed.value)));
+            }
+            catch (e) {
+                return Promise.resolve(err(e instanceof Error ? e : new Error(String(e))));
+            }
+        },
+    };
+    return Object.freeze(store);
+}

package/node_modules/@comis/memory/dist/observability-store/audit-mutations.d.ts

@@ -1,12 +1,11 @@
 /**
- * Security-audit sink helpers (AUDIT-01) — the only genuinely-new machinery in
- * Phase 176. Composes TWO existing analogs rather than inventing storage:
+ * Security-audit sink helpers. Composes TWO existing analogs rather than inventing storage:
  *
  *   1. **SQLite half** (mirrors `observability-mutations.ts`): `insertAuditEvent`
  *      / `queryAuditEvents` over the dedicated `obs_audit_events` table
- *      (DDL + indexes shipped by Plan 01 via `ensureObsAuditTable`). Bound
+ *      (DDL + indexes shipped via `ensureObsAuditTable`). Bound
  *      params only — `refs` is a `JSON.stringify`'d scrubbed blob, never
- *      interpolated SQL (T-176-12).
+ *      interpolated SQL.
  *
  *   2. **JSONL half** (clones `@comis/observability` `config-audit/append.ts`):
  *      `appendAuditJsonl` writes one scrubbed JSON line per event to
@@ -28,7 +27,7 @@ import type Database from "better-sqlite3";
 import { z } from "zod";
 import type { ObservabilityStore } from "./observability-store-types.js";
 /**
- * Schema for the `obs_audit_events` security-audit table (AUDIT-01) — the SSOT
+ * Schema for the `obs_audit_events` security-audit table — the SSOT
  * for the snake_case raw row, co-located with its sole `createRowMapper`
  * consumer (the SessionSummaryRollupDbRowSchema precedent — declared beside its
  * mapper, NOT in the row-schemas.ts SSOT file, which is at the 800-line cap).

package/node_modules/@comis/memory/dist/observability-store/audit-mutations.js

@@ -1,14 +1,13 @@
 // SPDX-License-Identifier: Apache-2.0
-// @allow-throw: appendAuditJsonl surfaces a JSONL-write failure as a throw so the daemon audit subscriber (obs-audit-sink.ts persistAuditRow) can try/catch it, log ERROR with hint+errorKind, and continue — the SQLite half still drains and the event is never silently dropped (T-176-11). The throw fires only on a filesystem failure (permissions/space/symlink-rejection), never on user data; the writer's signature is void (single-shot per the config-audit append analog), so Result.err would force every caller into an unwrap the subscriber does not need.
+// @allow-throw: appendAuditJsonl surfaces a JSONL-write failure as a throw so the daemon audit subscriber (obs-audit-sink.ts persistAuditRow) can try/catch it, log ERROR with hint+errorKind, and continue — the SQLite half still drains and the event is never silently dropped. The throw fires only on a filesystem failure (permissions/space/symlink-rejection), never on user data; the writer's signature is void (single-shot per the config-audit append analog), so Result.err would force every caller into an unwrap the subscriber does not need.
 /**
- * Security-audit sink helpers (AUDIT-01) — the only genuinely-new machinery in
- * Phase 176. Composes TWO existing analogs rather than inventing storage:
+ * Security-audit sink helpers. Composes TWO existing analogs rather than inventing storage:
  *
  *   1. **SQLite half** (mirrors `observability-mutations.ts`): `insertAuditEvent`
  *      / `queryAuditEvents` over the dedicated `obs_audit_events` table
- *      (DDL + indexes shipped by Plan 01 via `ensureObsAuditTable`). Bound
+ *      (DDL + indexes shipped via `ensureObsAuditTable`). Bound
  *      params only — `refs` is a `JSON.stringify`'d scrubbed blob, never
- *      interpolated SQL (T-176-12).
+ *      interpolated SQL.
  *
  *   2. **JSONL half** (clones `@comis/observability` `config-audit/append.ts`):
  *      `appendAuditJsonl` writes one scrubbed JSON line per event to
@@ -30,7 +29,7 @@ import { z } from "zod";
 import { appendRegularFile, rotateConfigAuditLogIfNeeded, ensureConfigAuditParentDir, } from "@comis/observability";
 import { createRowMapper } from "../row-mapper.js";
 /**
- * Schema for the `obs_audit_events` security-audit table (AUDIT-01) — the SSOT
+ * Schema for the `obs_audit_events` security-audit table — the SSOT
  * for the snake_case raw row, co-located with its sole `createRowMapper`
  * consumer (the SessionSummaryRollupDbRowSchema precedent — declared beside its
  * mapper, NOT in the row-schemas.ts SSOT file, which is at the 800-line cap).

package/node_modules/@comis/memory/dist/observability-store/cache-break-queries.d.ts

@@ -1,13 +1,13 @@
 /**
  * Cache-break analytics queries over `obs_diagnostics` (category:'cache_break').
  *
- * PERSIST-01 (Phase 176 Plan 04): "rate by reason over time" for detected
+ * "rate by reason over time" for detected
  * prompt-cache breaks — a clean `GROUP BY json_extract(details,'$.reason')` over the
  * EXISTING `obs_diagnostics` table + `idx_obs_diag_category` (NO new table, NO new
- * index — §14). Standalone (not on the `ObservabilityStore` interface) — a focused
+ * index). Standalone (not on the `ObservabilityStore` interface) — a focused
  * analytics read consumed by the fleet/explain surfaces; the `cache-stats-queries.ts`
  * sibling-module precedent. Parameterized bind args (the reason value is read out of
- * the JSON `details`, never interpolated into SQL — T-176-14).
+ * the JSON `details`, never interpolated into SQL).
  *
  * @module cache-break-queries
  */

package/node_modules/@comis/memory/dist/observability-store/cache-break-queries.js

@@ -2,13 +2,13 @@
 /**
  * Cache-break analytics queries over `obs_diagnostics` (category:'cache_break').
  *
- * PERSIST-01 (Phase 176 Plan 04): "rate by reason over time" for detected
+ * "rate by reason over time" for detected
  * prompt-cache breaks — a clean `GROUP BY json_extract(details,'$.reason')` over the
  * EXISTING `obs_diagnostics` table + `idx_obs_diag_category` (NO new table, NO new
- * index — §14). Standalone (not on the `ObservabilityStore` interface) — a focused
+ * index). Standalone (not on the `ObservabilityStore` interface) — a focused
  * analytics read consumed by the fleet/explain surfaces; the `cache-stats-queries.ts`
  * sibling-module precedent. Parameterized bind args (the reason value is read out of
- * the JSON `details`, never interpolated into SQL — T-176-14).
+ * the JSON `details`, never interpolated into SQL).
  *
  * @module cache-break-queries
  */
@@ -20,7 +20,7 @@ import { createRowMapper } from "../row-mapper.js";
  * `$.estCostUsd`); `$.reason` is coalesced to "" in SQL, and the SUM of a column
  * with no non-null rows is NULL — both kept nullable here for defense-in-depth (a
  * malformed row degrades to an empty result via the untyped-sqlite-gate-mandated
- * mapper, never an `as` cast). WEBUI-02 widened this from `{reason,count}`.
+ * mapper, never an `as` cast).
  */
 const cacheBreakRateMapper = createRowMapper(z.strictObject({
     reason: z.string().nullable(),

package/node_modules/@comis/memory/dist/observability-store/cache-break-types.d.ts

@@ -1,5 +1,5 @@
 /**
- * Cache-break query slice types (WEBUI-02, 179-04).
+ * Cache-break query slice types.
  *
  * Extracted from `observability-store-types.ts` for file-size cap compliance
  * (per-subdirectory cap = 500 lines) — the `cache-stats-types.ts` precedent. The
@@ -15,7 +15,7 @@
  * $-lost (`estCostUsd`) is the summed directly-lost cache-read saving for the reason
  * (0 for an unknown-priced model — honest, never NaN/null). Content-free: a closed
  * reason label + two numbers ONLY. Matches the IncidentReport `cacheBreaks?` type
- * (incident-report.ts:379) which already declared estCostUsd — closes that gap.
+ * (incident-report.ts), which also declares estCostUsd.
  */
 export interface CacheBreakReasonRate {
     reason: string;
@@ -30,7 +30,7 @@ export interface CacheBreakReasonRate {
  */
 export interface CacheBreakQueriesSlice {
     /**
-     * WEBUI-02 (179-04): cache-break rate by reason + the $-lost SUM over the existing
+     * Cache-break rate by reason + the $-lost SUM over the existing
      * `category:'cache_break'` diagnostics index. The store-method wrapper around the
      * standalone `queryCacheBreakRateByReason` (kept standalone for the fleet/explain
      * surfaces; exposed here as the `obs.cacheBreaks.byReason` RPC's deps-reachable

package/node_modules/@comis/memory/dist/observability-store/cache-break-types.js

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * Cache-break query slice types (WEBUI-02, 179-04).
+ * Cache-break query slice types.
  *
  * Extracted from `observability-store-types.ts` for file-size cap compliance
  * (per-subdirectory cap = 500 lines) — the `cache-stats-types.ts` precedent. The

package/node_modules/@comis/memory/dist/observability-store/fleet-window-rollup.d.ts

@@ -1,20 +1,20 @@
 /**
- * `reduceFleetWindow` (A2) — the PURE cross-session window-rollup reducer.
+ * `reduceFleetWindow` — the PURE cross-session window-rollup reducer.
  *
- * Folds the per-session A1 rollups (`SessionSummaryRollup[]`, produced by
- * `ObservabilityStore.aggregateSessionsInWindow` in 159-01) into ONE fleet
+ * Folds the per-session rollups (`SessionSummaryRollup[]`, produced by
+ * `ObservabilityStore.aggregateSessionsInWindow`) into ONE fleet
  * aggregate: session count, degraded rate, merged + capped top errorKinds,
  * breaker-trip total, per-tool ok/failed, and cost. This is the cross-session
  * reduce that `obs.explain` structurally cannot produce — it sees a single
  * session, this sees the whole window.
  *
- * THE LOAD-BEARING REQUIREMENT — real synthetic exclusion (NOT the 158-gate
- * no-op trap): when `excludeSynthetic` is set, the reducer drops every row whose
+ * THE LOAD-BEARING REQUIREMENT — real synthetic exclusion (not a no-op): when
+ * `excludeSynthetic` is set, the reducer drops every row whose
  * `source` is not `"runtime"` BEFORE reducing, so test/bench sessions cannot
  * inflate the operator-facing fleet metric. The filter acts on the REAL
- * `SessionSummaryRollup.source` field that 159-01 threaded onto the row's
- * `details` JSON — the Phase-158 gap-gate explicitly flagged that a bare
- * exclusion was a no-op when the field did not exist. The companion test pins
+ * `SessionSummaryRollup.source` field threaded onto the row's
+ * `details` JSON; a bare exclusion would be a no-op if the field did not exist.
+ * The companion test pins
  * this by asserting the two `excludeSynthetic` branches produce DIFFERENT counts.
  *
  * Purity + bounding (AGENTS §2.5 determinism; §2.7 bounded-payload): no clock, no
@@ -45,7 +45,7 @@ export interface FleetWindowRollup {
      * (`sessionCount`) and `degradedRate`, rather than re-deriving the count from
      * the unfiltered rows (which would double-count a synthetic degraded row and
      * make `sessions.degraded` exceed `total` / disagree with `degradedRate` and
-     * `sum(degradedByCause)`) (WR-01). Equals `sum(Object.values(degradedByCause))`
+     * `sum(degradedByCause)`). Equals `sum(Object.values(degradedByCause))`
      * before the cap (the cap only trims the cause SPREAD, not this total).
      */
     degradedCount: number;
@@ -54,7 +54,7 @@ export interface FleetWindowRollup {
     /** Merged per-kind failure counts, capped to the top-N by summed count. */
     topErrorKinds: Record<string, number>;
     /**
-     * QT2/QT3 — degraded session COUNTS bucketed by the named `endReason` cause
+     * Degraded session COUNTS bucketed by the named `endReason` cause
      * (the fleet-level degradation detector: "N degraded by context_exhausted, M
      * by output_starved"). ONLY degraded rows contribute; a missing/blank cause
      * folds into `"unknown"`. Capped at {@link FLEET_DEGRADED_BY_CAUSE_CAP},

package/node_modules/@comis/memory/dist/observability-store/fleet-window-rollup.js

@@ -7,7 +7,7 @@ const FLEET_TOP_ERROR_KINDS_CAP = 3;
 /**
  * How many distinct degradation CAUSES (`endReason` buckets) the fleet rollup's
  * `degradedByCause` keeps — hard cap, DoS-bounded. Sized to cover the FULL closed
- * degraded-cause union so a real cause can NEVER be silently dropped (IN-02): the
+ * degraded-cause union so a real cause can NEVER be silently dropped: the
  * reachable causes are the 9 non-`"success"` members of the `sessionEnd.endReason`
  * union (error, timeout, budget_exceeded, budget_exhausted, circuit_open,
  * provider_degraded, completed_with_tool_errors, context_exhausted,
@@ -31,7 +31,7 @@ const UNKNOWN_CAUSE = "unknown";
  * @returns the bounded, deterministic {@link FleetWindowRollup}.
  */
 export function reduceFleetWindow(rows, opts) {
-    // The load-bearing filter: act on the REAL source field threaded by 159-01.
+    // The load-bearing filter: act on the REAL source field threaded onto the rollup row.
     // `source === "runtime"` is a genuine predicate (the row carries the value),
     // NOT the 158-gate no-op (which filtered a field that did not exist).
     const kept = opts.excludeSynthetic ? rows.filter((r) => r.source === "runtime") : rows;
@@ -40,7 +40,7 @@ export function reduceFleetWindow(rows, opts) {
     let costUsd = 0;
     const mergedKinds = new Map();
     const mergedTools = new Map();
-    // QT2/QT3 — degraded-session counts bucketed by named endReason cause.
+    // Degraded-session counts bucketed by named endReason cause.
     const causeCounts = new Map();
     for (const r of kept) {
         if (r.degraded) {
@@ -56,10 +56,10 @@ export function reduceFleetWindow(rows, opts) {
         costUsd += r.costUsd;
         for (const [kind, n] of Object.entries(r.topErrorKinds)) {
             // Defensive coercion: the reducer is a public export reachable directly by
-            // the Phase-161 handler, so it must not assume its caller validated. A
+            // the fleet handler, so it must not assume its caller validated. A
             // non-finite/non-number count contributes 0 rather than producing "05"
             // (string concat) or NaN — keeping the `number` output contract honest
-            // regardless of caller hygiene (mirrors the A3 reader's Number.isFinite).
+            // regardless of caller hygiene (mirrors the session reader's Number.isFinite).
             const inc = typeof n === "number" && Number.isFinite(n) ? n : 0;
             mergedKinds.set(kind, (mergedKinds.get(kind) ?? 0) + inc);
         }
@@ -88,7 +88,7 @@ export function reduceFleetWindow(rows, opts) {
     const sessionCount = kept.length;
     return {
         sessionCount,
-        // The absolute degraded count over the kept rows — WR-01: the fleet handler
+        // The absolute degraded count over the kept rows — the fleet handler
         // reads this back so `sessions.degraded` shares the synthetic-excluded
         // population with `total`/`degradedRate` instead of counting unfiltered rows.
         degradedCount,

package/node_modules/@comis/memory/dist/observability-store/index.js

@@ -20,9 +20,9 @@ import { bindReset } from "./observability-reset.js";
 import { bindAuditMutations } from "./audit-mutations.js";
 import { buildCacheStatsQueries } from "./cache-stats-queries.js";
 import { queryCacheBreakRateByReason } from "./cache-break-queries.js";
-// AUDIT-01: the audit sink helpers (insert/query + the 0600 rotated JSONL writer).
+// The audit sink helpers (insert/query + the 0600 rotated JSONL writer).
 export { appendAuditJsonl, bindAuditMutations, DEFAULT_AUDIT_QUERY_LIMIT, MAX_AUDIT_QUERY_LIMIT, SECURITY_AUDIT_LOG_BASENAME, } from "./audit-mutations.js";
-// PERSIST-01 (Phase 176 Plan 04): the cache-break row-builder + the rate-by-reason
+// The cache-break row-builder + the rate-by-reason
 // query the daemon's obs-persistence-wiring consumes. cacheBreakEventToRow builds a
 // content-free category:'cache_break' DiagnosticRow with a computed est-$;
 // queryCacheBreakRateByReason is the GROUP BY over the existing obs_diagnostics index.
@@ -41,17 +41,17 @@ export { queryCacheBreakRateByReason } from "./cache-break-queries.js";
 export function createObservabilityStore(db) {
     const store = {
         ...bindQueries(db),
-        // COST-03: the 900000-ms quarter-hour aggregate + the pricing-coverage column.
+        // The 900000-ms quarter-hour aggregate + the pricing-coverage column.
         ...bindAggregates(db),
-        // SPEND-03: the spend accumulator's boot rehydration read (getRollingSpendUsd).
+        // The spend accumulator's boot rehydration read (getRollingSpendUsd).
         ...bindSpendQueries(db),
         ...bindMutations(db),
         ...bindReset(db),
-        // AUDIT-01: security-audit insert/query over the dedicated obs_audit_events table.
+        // Security-audit insert/query over the dedicated obs_audit_events table.
         ...bindAuditMutations(db),
         // Durable cache-stats queries over `obs_token_usage`.
         ...buildCacheStatsQueries(db),
-        // WEBUI-02 (179-04): the deps-reachable cache-break rate + $-lost read (the
+        // The deps-reachable cache-break rate + $-lost read (the
         // store-method wrapper around the standalone GROUP BY) the obs.cacheBreaks.byReason
         // RPC consumes — the queryAuditEvents mold.
         queryCacheBreaksByReason: (params = {}) => queryCacheBreakRateByReason(db, params),

package/node_modules/@comis/memory/dist/observability-store/observability-aggregates.d.ts

@@ -1,16 +1,16 @@
 /**
- * Cost aggregation with pricing coverage (COST-03, Phase 179 WS6).
+ * Cost aggregation with pricing coverage.
  *
  * Two bucket widths over the SAME columns:
  *   - `aggregateQuarterHourly` — a 900000-ms (15-min) bucket. The four quarter-hour
  *     buckets inside an hour SUM (cost / tokens / calls / cacheSaved) to that hour's
- *     single hourly bucket (the conservation invariant the WS6 test pins).
+ *     single hourly bucket (the conservation invariant the test pins).
  *   - `aggregateHourlyCost` — a 3600000-ms (60-min) bucket; the `comis cost export`
  *     default granularity. Identical columns + coverage so the export's CSV header is
  *     stable across granularities.
  *
  * Both build their SELECT from one parameterized statement (the only difference is the
- * integer-division divisor), so they cannot drift. Each bucket carries the E1
+ * integer-division divisor), so they cannot drift. Each bucket carries the
  * pricing-coverage pair so a `comis cost export` consumer (a finance review) sees how
  * trustworthy the dollars are: the SUM(cost_correction), the per-bucket count of
  * `unknown`/NULL `pricing_state` rows (`missingPricingCount` — dollars NOT

package/node_modules/@comis/memory/dist/observability-store/observability-aggregates.js

@@ -1,17 +1,17 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * Cost aggregation with pricing coverage (COST-03, Phase 179 WS6).
+ * Cost aggregation with pricing coverage.
  *
  * Two bucket widths over the SAME columns:
  *   - `aggregateQuarterHourly` — a 900000-ms (15-min) bucket. The four quarter-hour
  *     buckets inside an hour SUM (cost / tokens / calls / cacheSaved) to that hour's
- *     single hourly bucket (the conservation invariant the WS6 test pins).
+ *     single hourly bucket (the conservation invariant the test pins).
  *   - `aggregateHourlyCost` — a 3600000-ms (60-min) bucket; the `comis cost export`
  *     default granularity. Identical columns + coverage so the export's CSV header is
  *     stable across granularities.
  *
  * Both build their SELECT from one parameterized statement (the only difference is the
- * integer-division divisor), so they cannot drift. Each bucket carries the E1
+ * integer-division divisor), so they cannot drift. Each bucket carries the
  * pricing-coverage pair so a `comis cost export` consumer (a finance review) sees how
  * trustworthy the dollars are: the SUM(cost_correction), the per-bucket count of
  * `unknown`/NULL `pricing_state` rows (`missingPricingCount` — dollars NOT
@@ -31,14 +31,14 @@
  */
 import { z } from "zod";
 import { createRowMapper } from "../row-mapper.js";
-/** The pricing-coverage row schema (WEBUI-02) — the three E1 pricing-state tallies. */
+/** The pricing-coverage row schema — the three pricing-state tallies. */
 const pricingCoverageMapper = createRowMapper(z.strictObject({
     priced: z.number(),
     free: z.number(),
     unknown: z.number(),
 }));
 /**
- * HG-01 per-tool even-split row schema — the three attributable columns + the
+ * Per-tool even-split row schema — the three attributable columns + the
  * raw `tool_tag` JSON blob (parsed + validated in JS by {@link parseDistinctTools}
  * rather than in SQL: better-sqlite3 has no JSON-array iteration, and the
  * distinct-set is already content-free names). `tool_tag` is `nullable` so the
@@ -73,7 +73,7 @@ function parseDistinctTools(raw) {
     return [...new Set(names)];
 }
 /**
- * The bucket row schema (COST-03) — the `HourlyBucketDbRow` columns PLUS the E1
+ * The bucket row schema — the `HourlyBucketDbRow` columns PLUS the
  * pricing-coverage tallies (`missing_pricing_count`; `priced_count`/`free_count`
  * from which the bound method derives the dominant `pricingState`). Defined HERE
  * (its ONLY consumer) rather than row-schemas.ts so it is not a dead public export,
@@ -91,7 +91,7 @@ const QuarterHourBucketDbRowSchema = z.strictObject({
     free_count: z.number(),
     missing_pricing_count: z.number(),
 });
-/** The bucket mapper (COST-03, the 900000-/3600000-ms aggregates). */
+/** The bucket mapper (the 900000-/3600000-ms aggregates). */
 const quarterHourBucketMapper = createRowMapper(QuarterHourBucketDbRowSchema);
 /**
  * Derive the bucket's DOMINANT pricing state from the per-state counts.
@@ -172,12 +172,12 @@ export function bindAggregates(db) {
             missingPricingCount: r.missing_pricing_count,
         }));
     }
-    // HG-01: the per-tool even-split for ONE agent. Pull the agent's rows that
+    // The per-tool even-split for ONE agent. Pull the agent's rows that
     // carry a non-null tool_tag (a NULL-tag turn has no tool to attribute to), then
     // even-split each row's cost/tokens/calls across its DISTINCT tools in JS (the
     // JSON-array split has no clean SQL form in better-sqlite3). The split conserves:
-    // Σ per-tool cost === Σ attributable-row cost_total (the COST-01 comment's promise,
-    // now a real contract — pinned by the conservation test). Content-free (tool names
+    // Σ per-tool cost === Σ attributable-row cost_total (a real contract, pinned by
+    // the conservation test). Content-free (tool names
     // + numbers only). The WHERE is parameterized (agent_id + the optional sinceMs) —
     // never interpolated (the untyped-sqlite + SQL-injection gate).
     const toolCostByAgentAllStmt = db.prepare(`
@@ -220,8 +220,8 @@ export function bindAggregates(db) {
         // Sort by cost desc (the byProvider/billing convention — biggest spender first).
         return [...byTool.values()].sort((a, b) => b.cost - a.cost);
     }
-    // WEBUI-02 (179-04): the daemon-wide three-state pricing-coverage count. Reuses
-    // the SAME E1 CASE expressions as the cost buckets above (priced / free / the
+    // The daemon-wide three-state pricing-coverage count. Reuses
+    // the SAME CASE expressions as the cost buckets above (priced / free / the
     // unknown-or-NULL fall-through) so the snapshot's coverage and the export's
     // per-bucket coverage cannot drift. Content-free (three integer counts).
     function pricingCoverage(sinceMs) {

package/node_modules/@comis/memory/dist/observability-store/observability-mutations.d.ts

@@ -12,22 +12,22 @@ import type { ObservabilityStore, DiagnosticRow } from "./observability-store-ty
 /** Shape of the subset of ObservabilityStore implemented by this module. */
 export type ObservabilityMutations = Pick<ObservabilityStore, "insertTokenUsage" | "insertDelivery" | "insertDiagnostic" | "insertChannelSnapshot" | "insertSystemPromptReport">;
 /**
- * PERSIST-01: map an `observability:cache_break` event to a content-free
- * `obs_diagnostics` row under `category:"cache_break"` (Landmine L4 — a DISTINCT
+ * Map an `observability:cache_break` event to a content-free
+ * `obs_diagnostics` row under `category:"cache_break"` (a DISTINCT
  * category, NOT "health_signal", so "rate by reason" is a clean
  * `GROUP BY json_extract(details,'$.reason')` over the existing
- * `idx_obs_diag_category` — NO new table, §14). Mirrors the daemon's
+ * `idx_obs_diag_category` — NO new table). Mirrors the daemon's
  * `sandboxDowngradeRefusedEventToRow` row-builder mold.
  *
- * **est-$ is COMPUTED here (decision #1, Landmine L1).** The event carries NO
+ * **est-$ is COMPUTED here.** The event carries NO
  * dollar field, so the directly-lost cache-read saving is reconstructed as
  * `tokenDrop × resolveModelPricing(provider, model).cacheRead`: a catalog-priced
  * model yields a non-zero estimate; an unknown model yields 0 (ZERO_COST.cacheRead
  * === 0 — honest best-effort, never a fabricated cost). The companion
- * `pricing_state` column on `obs_token_usage` (PERSIST-03) surfaces the unknown so
+ * `pricing_state` column on `obs_token_usage` surfaces the unknown so
  * an operator sees coverage.
  *
- * **I3 content-free (the load-bearing constraint).** The event's `toolsAdded`/
+ * **Content-free (the load-bearing constraint).** The event's `toolsAdded`/
  * `toolsRemoved`/`toolsSchemaChanged` are tool-NAME arrays (already MCP-sanitized to
  * bare `'mcp'` at the emit, but STILL names) — they are NEVER stored. They are
  * reduced to a `changedDimsDigest` carrying only the COUNTS of changed dimensions