comisai 1.0.44 → 1.0.46

package/node_modules/@comis/agent/dist/executor/lcd-condense-trigger.js

@@ -1,12 +1,12 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * LCD afterTurn CONDENSE pass (Phase 130, C2) — the mirror of the leaf pass.
+ * LCD afterTurn CONDENSE pass — the mirror of the leaf pass.
  *
  * Where {@link maybeRunLeafPass} (lcd-compaction-trigger.ts) folds a contiguous
  * run of raw MESSAGES into a depth-0 leaf, this pass folds a contiguous run of
  * ≥`condensedMinFanout` same-depth SUMMARIES into one coarser depth+1 condensed
  * summary — turning the single-tier LCD compaction into a multi-tier zoomable
- * hierarchy (C2). It runs AFTER the leaf pass at the afterTurn boundary, so a turn
+ * hierarchy. It runs AFTER the leaf pass at the afterTurn boundary, so a turn
  * that just created the Nth leaf can immediately fold it.
  *
  * It lives in its OWN module (not in lcd-compaction-trigger.ts) to keep that file
@@ -14,37 +14,37 @@
  * ({@link resolveContext}) lives in the trigger and returns BOTH the leaf history
  * and the per-depth contiguous summary-ref runs, so utilization + leaf selection
  * + condense selection all read ONE `getContextItems`/`getMessages`/`getSummaries`
- * snapshot (the CR-01/CR-02 "one resolved view is source of truth" invariant).
+ * snapshot (the "one resolved view is source of truth" invariant).
  *
  * Three load-bearing contracts (mirroring {@link maybeRunLeafPass}):
  *   1. NON-FATAL: a summarizer / store failure must NEVER fail the live turn —
  *      the whole body is wrapped in one try/catch → WARN (errorKind `dependency`)
  *      and returns; the awaiting call site simply awaits a promise that never
- *      rejects (T-130-07). The condense summarizer's own deterministic Level-3
+ *      rejects. The condense summarizer's own deterministic Level-3
  *      truncation is the in-pass degrade; a store failure is the outer degrade.
  *   2. AGENT-SIDE TOKENS: the before-size is the STORED `Σ child.tokenCount` (each
  *      child summary's persisted `tokenCount`); the persisted condensed
  *      `tokenCount` is the condense summarizer's `tokenCount`. The store NEVER
- *      computes tokens (the 127 contract).
+ *      computes tokens (the contract keeps core/memory estimator-free).
  *   3. INJECTED CLOCK: the condensed `createdAt` comes from the supplied `now`,
  *      never the ambient wall-clock global (the globals gate; AGENTS.md §2.2).
  *
- * Pitfall 3 (contiguity) is enforced BY CONSTRUCTION: a {@link SummaryRefRun}
+ * Contiguity is enforced BY CONSTRUCTION: a {@link SummaryRefRun}
  * breaks at any message-ref or depth change, so {@link selectCondensableTier} can
  * only ever pick a CONTIGUOUS same-depth run, and the `[startOrdinal, endOrdinal]`
  * window is the run's own ordinals → the store range-replace cannot corrupt
- * ordering or merge a non-contiguous fanout (T-130-08).
+ * ordering or merge a non-contiguous fanout.
  *
- * Bounded (T-130-06): ONE condense pass per call. 130 fires inline + synchronously
- * (mirrors the 129 leaf pass); deferred/background condensation + bounded spend +
- * a circuit breaker are Phase 132 — so the whole pass lives behind THIS one
- * function for a clean 132 swap (the SAME injected-summarizer seam as the leaf).
+ * Bounded: ONE condense pass per call, fired inline + synchronously at the
+ * afterTurn boundary (mirrors the leaf pass). The whole pass lives behind THIS
+ * one function — the SAME injected-summarizer seam as the leaf — so
+ * deferred/background scheduling or spend/breaker governance can swap in cleanly.
  *
  * Architecture cut (agent↛memory): this module imports ONLY the CORE
  * `ContextStorePort`/`ContextStoreScope` TYPES + the agent-side condense
  * summarizer + the trigger's resolved-view walk. The concrete `createLcdStore` is
  * daemon-injected — this module NEVER imports the memory package directly. It
- * NEVER logs summary content — ids/counts/durations/level only (T-130-09).
+ * NEVER logs summary content — ids/counts/durations/level only.
  *
  * @module
  */
@@ -58,7 +58,7 @@ import { resolveContext } from "./lcd-compaction-trigger.js";
 /**
  * The most recent EXISTING summary at `depth` (for continuity) — passed to the
  * condense summarizer as `previousSummary`. Operates on the ALREADY-READ
- * oldest-first `getSummaries` snapshot from `resolveContext` (WR-01: one resolved
+ * oldest-first `getSummaries` snapshot from `resolveContext` (one resolved
  * view is the source of truth — never a second store read), so the LAST
  * same-depth summary is the most recent. `undefined` when none exists yet at the
  * target depth.
@@ -80,9 +80,9 @@ function previousSummaryAtDepth(summaries, depth) {
  * @param store          The injected core ContextStorePort (daemon-injected concrete store).
  * @param scope          The SECURITY scope columns (conversationId/tenantId/agentId/sessionKey).
  * @param opts           The gating + sizing knobs from `config.contextEngine`.
- * @param summarizerDeps The injected summarizer + model getters (the 132 spend-governance seam). Absent ⇒ no-op.
+ * @param summarizerDeps The injected summarizer + model getters (the spend-governance seam). Absent ⇒ no-op.
  * @param now            Injected wall-clock ms (`deps.clock.now()`) — NEVER the ambient time global. Stamps `timestamp`.
- * @param nowFn          Injected clock CALLABLE (`deps.clock.now`) for the two pass-timing reads (O1). Absent ⇒ durationMs 0.
+ * @param nowFn          Injected clock CALLABLE (`deps.clock.now`) for the two pass-timing reads. Absent ⇒ durationMs 0.
  * @param logger         For the completion INFO + the non-fatal WARN.
  * @param eventBus       Optional bus to emit `context:dag_compacted` on a completed pass.
  */
@@ -92,28 +92,28 @@ export async function maybeRunCondensePass(store, scope, opts, summarizerDeps, n
     if (summarizerDeps === undefined)
         return;
     if (!Number.isFinite(opts.windowTokens) || opts.windowTokens <= 0) {
-        // Review IN-01: never silently disarm — leave the same one-line DEBUG
+        // Never silently disarm — leave the same one-line DEBUG
         // breadcrumb the leaf gate leaves, so a disarmed condense pass is
-        // diagnosable from logs alone (phase invariant: no silent trigger disarm).
+        // diagnosable from logs alone (invariant: no silent trigger disarm).
         logger.debug({ conversationId: scope.conversationId, agentId: scope.agentId, step: "lcd-condense-gate", reason: "bad-window", windowTokens: opts.windowTokens }, "lcd condense pass gate skip");
         return;
     }
     const conversationId = scope.conversationId;
-    // O1: capture a pass-START clock read at entry (the injected clock CALLABLE —
+    // Capture a pass-START clock read at entry (the injected clock CALLABLE —
     // NEVER Date.now()/performance.now(), the globals gate). The second read at
     // emit gives the real elapsed; a scalar-only caller degrades to 0.
     const passStart = nowFn?.() ?? now;
     try {
         // Resolve the model-facing context ONCE — the SAME walk the leaf pass uses,
         // now also returning the per-depth contiguous summary-ref runs + the
-        // `getSummaries` snapshot (CR-01/CR-02 + WR-01: one resolved view is the
+        // `getSummaries` snapshot (one resolved view is the
         // source of truth). The condense selection reads `summaryRunsByDepth`; taint
         // rides the selected children; `previousSummary` rides `summaries` — NO
         // second `getSummaries` call observes a possibly-diverged later snapshot.
-        // R4 (132-03): resolveContext reads agent + tenant scoped (WR-02) via `scope`.
+        // Read isolation: resolveContext reads agent + tenant scoped via `scope`.
         const { summaryRunsByDepth, summaries, resolvedTokens } = resolveContext(store, scope);
         // Context pressure = resolved-view tokens / W — the SAME utilization the leaf
-        // gate computes (CR-02). Above `contextThreshold` the condense selector drops to
+        // gate computes. Above `contextThreshold` the condense selector drops to
         // the HARD fanout so a pressured tier still drains; at/below it the soft fanout
         // governs. The deepest qualifying run is selected so the hierarchy climbs past
         // depth 1 (depth-1→depth-2 fires once enough contiguous depth-1 summaries exist).
@@ -132,7 +132,7 @@ export async function maybeRunCondensePass(store, scope, opts, summarizerDeps, n
                 hint: "condense run produced an inverted ordinal window; skipping the pass to avoid corrupting ordering",
                 errorKind: "precondition",
             }, "LCD condense pass skipped: ordinal-window divergence");
-            // Phase 160 I1: emit a content-free context:dag_degraded so the inverted-
+            // Emit a content-free context:dag_degraded so the inverted-
             // window divergence persists as a health_signal row (queryable by the
             // fleet lens) instead of being a Pino-only WARN. Identifiers + reason +
             // timing only — NEVER summary content (mirrors the context:dag_compacted
@@ -148,27 +148,27 @@ export async function maybeRunCondensePass(store, scope, opts, summarizerDeps, n
             });
             return;
         }
-        // SUMW-01: prefix-trim the selected run to the LONGEST child prefix whose
+        // Prefix-trim the selected run to the LONGEST child prefix whose
         // Σ tokenCount fits the RESOLVED summarizer's window (override-aware via
         // resolveSummarizerWindowTokens — never the getModel() session-primary
         // snapshot) minus the condense target + prompt-template overhead + the
         // ACTUAL threaded previousSummary, so a condense pass never concatenates
         // more child tokens than the summarizer that actually runs can read.
-        // Ordinal integrity (T-178-10): a prefix of a contiguous run stays
+        // Ordinal integrity: a prefix of a contiguous run stays
         // contiguous, so [startOrdinal, children[keep-1].ordinal] remains a valid
         // range-replace window and the trimmed children survive untouched in the
         // store for a later pass. The no-trim path is byte-identical
         // (effectiveRun === run); pressureHigh and selectCondensableTier are unchanged.
         const summarizerWindow = resolveSummarizerWindowTokens(summarizerDeps);
-        // Review WR-03: the target depth and its previousSummary are knowable
+        // The target depth and its previousSummary are knowable
         // BEFORE the budget — a run's children share ONE depth by construction (a
         // SummaryRefRun breaks on any depth change), so the condensed depth is
         // run.depth + 1 regardless of how the trim lands. Subtract the ACTUAL
         // previousSummary tokens: the flat 2_048 overhead covers only the
         // instruction TEMPLATE, while previousSummary at this depth is
         // ~condensedTargetTokens-sized at defaults (2_000; the knob allows
-        // 10_000) — hoping the flat reserve covered both was short by its own
-        // arithmetic and overflowed near-exactly-filled windows.
+        // 10_000) — a flat reserve alone is short by its own arithmetic and
+        // overflows near-exactly-filled windows.
         const depth = run.depth + 1;
         const previousSummary = previousSummaryAtDepth(summaries, depth);
         const prevTokens = previousSummary === undefined
@@ -187,15 +187,15 @@ export async function maybeRunCondensePass(store, scope, opts, summarizerDeps, n
             }
             if (keep < run.children.length) {
                 if (keep < 2) {
-                    // A 1-child condense is meaningless re-summarization — honest skip
-                    // (T-178-12): observable via a content-free DEBUG with both numbers
-                    // (I7), never WARN spam, never a throw.
+                    // A 1-child condense is meaningless re-summarization — honest skip:
+                    // observable via a content-free DEBUG with both numbers,
+                    // never WARN spam, never a throw.
                     logger.debug({ conversationId, agentId: scope.agentId, step: "lcd-condense-clamp", summarizerWindow, childTokenBudget, firstChildTokens: run.children[0].tokenCount }, "lcd condense pass skipped: summarizer window cannot fit a 2-child run");
                     return;
                 }
-                // Review IN-03 (deliberate): the fanout gate governs run SELECTION
+                // Deliberate: the fanout gate governs run SELECTION
                 // only — a binding window trim may fold FEWER children than the soft
-                // `condensedMinFanout` that selected the run (SUMW-01-C1 pins fanout 4
+                // `condensedMinFanout` that selected the run (the tests pin fanout 4
                 // selecting, 3 folding). Preferable to never condensing under a small
                 // summarizer; the trimmed children survive for a later pass.
                 effectiveRun = {
@@ -204,45 +204,45 @@ export async function maybeRunCondensePass(store, scope, opts, summarizerDeps, n
                     startOrdinal: run.startOrdinal,
                     endOrdinal: run.children[keep - 1].ordinal,
                 };
-                // Numbers only (I7) — per-pass DEBUG, never WARN (the trim is normal adaptive behavior).
+                // Numbers only — per-pass DEBUG, never WARN (the trim is normal adaptive behavior).
                 logger.debug({ conversationId, agentId: scope.agentId, step: "lcd-condense-clamp", summarizerWindow, childTokenBudget, keptChildren: keep, trimmedChildren: run.children.length - keep }, "lcd condense run prefix-trimmed to the resolved summarizer window");
             }
         }
-        // Derive the rest of the condensed node's metadata from the KEPT children
-        // (RESEARCH A6): taint = OR(children.taint); descendantCount / time-range
+        // Derive the rest of the condensed node's metadata from the KEPT children:
+        // taint = OR(children.taint); descendantCount / time-range
         // are recomputed STORE-SIDE from the child rows (advisory here). depth was
         // derived above (run.depth + 1 — identical to max(child depth) + 1, since
         // the run's children share one depth by construction).
         const childSummaryIds = effectiveRun.children.map((c) => c.summaryId);
         // taint = OR(children.taint): read taint off the SELECTED children — the
         // resolved-view `CondenseChildSummary` carries `taint` from the SAME
-        // `getSummaries` snapshot the run was selected from (WR-01). A second
-        // `getSummaries` call could observe a diverged later snapshot (the pass goes
-        // deferred/async in Phase 132) and silently mis-propagate the trust boundary.
-        // A tainted child taints the condensed parent (T-130; enforcement is Phase 132).
+        // `getSummaries` snapshot the run was selected from. A second
+        // `getSummaries` call could observe a diverged later snapshot (the pass may
+        // run deferred/async) and silently mis-propagate the trust boundary.
+        // A tainted child taints the condensed parent.
         const taint = effectiveRun.children.some((c) => c.taint);
         // Summarize the child CONTENT via the 3-level escalation (non-fatal inside —
         // always returns a result). The before-size is the STORED Σ child tokenCount.
         // `previousSummary` is the SAME resolved-snapshot read the budget above
-        // already accounted (WR-01/WR-03) — never a re-query.
+        // already accounted — never a re-query.
         const result = await summarizeCondensedChunk(effectiveRun.children, summarizerDeps, {
             reserveTokens: opts.condensedTargetTokens,
             previousSummary,
-            depth, // SUM-01: thread computed depth so d1/d2/d3+ prompt styles actually fire
+            depth, // Thread the computed depth so the d1/d2/d3+ prompt styles actually fire
         });
         // Persist + link + range-replace at the run's EXACT [startOrdinal, endOrdinal]
-        // SUMMARY-ref window — one atomic store transaction (C2). The store recomputes
+        // SUMMARY-ref window — one atomic store transaction. The store recomputes
         // descendantCount + time-range from the child summary rows; depth/taint/
         // fallback/tokenCount/content come from here (the agent-side authority).
         // Capture the summaryId returned by appendCondensedSummary for the onCondensed
-        // callback (Phase 172-02: the distillation hook seam).
+        // callback (the distillation hook seam).
         const summaryId = store.appendCondensedSummary({
             scope,
             content: result.content,
             tokenCount: result.tokenCount,
             // Advisory only — the store RECOMPUTES descendantCount (= Σ child
             // descendantCount) + time-range (min/max child earliest/latest) from the
-            // child summary rows (the store is the authority, Plan 01). 0 / `now` are
+            // child summary rows (the store is the authority). 0 / `now` are
             // placeholders the store ignores.
             descendantCount: 0,
             earliestAt: now,
@@ -256,9 +256,9 @@ export async function maybeRunCondensePass(store, scope, opts, summarizerDeps, n
             childSummaryIds,
             depth,
         });
-        // Phase 172-02: fire the optional distillation hook immediately after the
+        // Fire the optional distillation hook immediately after the
         // condensed summary is persisted. Non-fatal — errors from the hook MUST NOT
-        // propagate into the condense pass's own error handling (T-130-07).
+        // propagate into the condense pass's own error handling.
         try {
             onCondensed?.(summaryId, result.content, result.fallback, depth);
         }
@@ -272,7 +272,7 @@ export async function maybeRunCondensePass(store, scope, opts, summarizerDeps, n
                 errorKind: "dependency",
             }, "onCondensed hook error (non-fatal)");
         }
-        // OBS-01 (Phase 180): the small-model G4 detector at the condense depth — a
+        // The small-model language-mismatch detector at the condense depth — a
         // non-Latin run of children whose condensed summary came back Latin emits
         // context:summary_language_mismatch (depth = this condense depth). Source =
         // the children summaries' concatenated content (the SAME input the condense
@@ -285,7 +285,7 @@ export async function maybeRunCondensePass(store, scope, opts, summarizerDeps, n
             depth,
             nowMs: now,
         });
-        // O1 (Phase 133): real pass-timing — a SECOND injected-clock read at emit
+        // Real pass-timing — a SECOND injected-clock read at emit
         // minus the pass-entry `passStart`. The injected clock is the only time
         // source (the ambient wall-clock global is banned); a scalar-only caller
         // (no `nowFn`) degrades to 0 (passStart === now). Clamped non-negative.
@@ -318,7 +318,7 @@ export async function maybeRunCondensePass(store, scope, opts, summarizerDeps, n
         }, "LCD condensed summary persisted");
     }
     catch (err) {
-        // Non-fatal (T-130-07): any failure degrades to a WARN + return — the live
+        // Non-fatal: any failure degrades to a WARN + return — the live
         // turn is unaffected (mirror maybeRunLeafPass). errorKind `dependency` (a
         // summarizer/store failure is an external-dependency fault).
         logger.warn({
@@ -335,8 +335,8 @@ export async function maybeRunCondensePass(store, scope, opts, summarizerDeps, n
  * Thin afterTurn call-site wiring for the condense pass: resolve the condense
  * summarizer deps, gate on their presence, build {@link CondensePassOptions} from
  * `config.contextEngine` (defaulted via `ContextEngineConfigSchema`) with
- * `windowTokens` taken from the threaded per-turn `budgetWindowTokens` (SUMW-02 —
- * the SAME budget window the assembler + preflight use, NOT the session model's
+ * `windowTokens` taken from the threaded per-turn `budgetWindowTokens` (the
+ * SAME budget window the assembler + preflight use, NOT the session model's
  * configured window), then delegate to {@link maybeRunCondensePass}. Clones
  * `runLeafPassAfterTurn`.
  *
@@ -364,14 +364,14 @@ export async function runCondensePassAfterTurn(params) {
         condensedMinFanoutHard: cfg.condensedMinFanoutHard,
         contextThreshold: cfg.contextThreshold,
         condensedTargetTokens: cfg.condensedTargetTokens,
-        // SUMW-02: the utilization + pressureHigh denominator W is the threaded
+        // The utilization + pressureHigh denominator W is the threaded
         // per-turn budget window (min(reconciled contextWindow, class cap)) —
-        // never the summarizer snapshot's configured window, which kept the hard
-        // fanout from ever firing on capped small models (DIST-01). The
+        // never the summarizer snapshot's configured window, which would keep the
+        // hard fanout from ever firing on capped small models. The
         // maybeRunCondensePass finite-positive gate is unchanged.
         windowTokens: budgetWindowTokens,
     }, summarizerDeps, now, nowFn, logger, eventBus, 
-    // Phase 172-02: thread the onCondensed distillation hook seam through to
+    // Thread the onCondensed distillation hook seam through to
     // maybeRunCondensePass. When present, fires with (summaryId, content, fallback,
     // depth) immediately after store.appendCondensedSummary returns.
     onCondensed);

package/node_modules/@comis/agent/dist/executor/lcd-distillation-runner.d.ts

@@ -1,5 +1,5 @@
 /**
- * LCD→LTM distillation runner (Phase 172, DIST-01..04).
+ * LCD→LTM distillation runner.
  *
  * Fires after `store.appendCondensedSummary` returns a summaryId (via the
  * `onCondensed` callback seam on `lcd-condense-trigger.ts`). Gate-heavy,
@@ -10,7 +10,7 @@
  * Architecture cut (agent↛memory): this module imports ONLY TYPE-only ports
  * from @comis/core and agent-side helpers. It NEVER imports @comis/memory.
  * The concrete ContextStorePort and MemoryPort implementations are daemon-injected.
- * It NEVER logs summary content — ids/counts/durations/errorKinds only (T-130-09).
+ * It NEVER logs summary content — ids/counts/durations/errorKinds only.
  *
  * @module
  */
@@ -43,7 +43,7 @@ export interface RunDistillationPassParams {
         /** Fire-and-forget embedding queue. Optional — absent ⇒ no embedding. */
         embeddingEnqueue?: (entryId: string, content: string) => void;
         /**
-         * WR-03: optional injected clock CALLABLE for the write-path completion
+         * Optional injected clock CALLABLE for the write-path completion
          * timing (entry → emit two reads → durationMs). Bound to the daemon's
          * ClockPort — NEVER Date.now(). Absent ⇒ durationMs is omitted from the INFO
          * line (timing degrades, the pass still runs).
@@ -70,7 +70,7 @@ export interface RunDistillationPassParams {
     };
 }
 /**
- * Non-fatal distillation pass (T-130-07 pattern). Gate-heavy; returns early on
+ * Non-fatal distillation pass. Gate-heavy; returns early on
  * every gate miss. The outer try/catch degrades the ENTIRE pass to a WARN on
  * unexpected failure — the live turn is NEVER affected.
  */

package/node_modules/@comis/agent/dist/executor/lcd-distillation-runner.js

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * LCD→LTM distillation runner (Phase 172, DIST-01..04).
+ * LCD→LTM distillation runner.
  *
  * Fires after `store.appendCondensedSummary` returns a summaryId (via the
  * `onCondensed` callback seam on `lcd-condense-trigger.ts`). Gate-heavy,
@@ -11,7 +11,7 @@
  * Architecture cut (agent↛memory): this module imports ONLY TYPE-only ports
  * from @comis/core and agent-side helpers. It NEVER imports @comis/memory.
  * The concrete ContextStorePort and MemoryPort implementations are daemon-injected.
- * It NEVER logs summary content — ids/counts/durations/errorKinds only (T-130-09).
+ * It NEVER logs summary content — ids/counts/durations/errorKinds only.
  *
  * @module
  */
@@ -22,13 +22,13 @@ import { LEAF_FALLBACK_SUMMARY_MARKER, CONDENSED_FALLBACK_SUMMARY_MARKER, } from
 // Main exported function
 // ---------------------------------------------------------------------------
 /**
- * Non-fatal distillation pass (T-130-07 pattern). Gate-heavy; returns early on
+ * Non-fatal distillation pass. Gate-heavy; returns early on
  * every gate miss. The outer try/catch degrades the ENTIRE pass to a WARN on
  * unexpected failure — the live turn is NEVER affected.
  */
 export async function runDistillationPassAfterTurn(params) {
     const { summaryId, scope, content, fallback, depth, now, deps } = params;
-    // GATE 1: R4 fail-closed — incomplete scope → return without any write.
+    // GATE 1: fail-closed scope isolation — incomplete scope → return without any write.
     // An empty agentId, tenantId, or conversationId is a misconfigured session;
     // never write cross-scope memory rows from an unknown scope.
     if (!scope.tenantId || !scope.agentId || !scope.conversationId) {
@@ -103,7 +103,7 @@ export async function runDistillationPassAfterTurn(params) {
         return;
     }
     // All gates passed — enter the write path (non-fatal).
-    // WR-03: time the whole write boundary via the injected clock (entry read);
+    // Time the whole write boundary via the injected clock (entry read);
     // the completion read happens at the INFO line below. `now` is the entry value
     // when no clock callable is injected (durationMs then degrades to 0/omitted).
     const startMs = deps.nowFn ? deps.nowFn() : now;
@@ -125,7 +125,7 @@ export async function runDistillationPassAfterTurn(params) {
                 hint: "LCD distillation skipped: condensed summary matched a secret/dangerous/suspicious pattern",
                 errorKind: "validation",
             }, "LCD distillation skipped: failed the memory-write security scan");
-            // IN-04: emit the documented reason:"validation" skip so the
+            // Emit the documented reason:"validation" skip so the
             // security-relevant secret-egress block is fleet-observable (consistent
             // with every other gate). CONTENT-FREE: ids/agentId/sessionKey only —
             // NEVER the matched secret text or the verdict patterns.
@@ -137,14 +137,14 @@ export async function runDistillationPassAfterTurn(params) {
             });
             return;
         }
-        // GATE 8: dedup check (DIST-02) — cosine when vec present, FTS/lexical fallback.
-        // R4 read-isolation (CR-02): SqliteMemoryAdapter.search() filters rows by
+        // GATE 8: dedup check — cosine when vec present, FTS/lexical fallback.
+        // Agent read-isolation: SqliteMemoryAdapter.search() filters rows by
         // sessionKey.tenantId for the TENANT boundary, but applies the load-bearing
         // `agent_id = ?` AGENT predicate ONLY when options.agentId is set (it ignores
         // sessionKey.agentId/.userId/.channelId entirely). So the agent filter MUST
         // ride in the options object — passing it on the SessionKey alone is a no-op
         // and would let a different agent's near-duplicate in the same tenant suppress
-        // this agent's write (a cross-agent dedup false positive + R4 read gap).
+        // this agent's write (a cross-agent dedup false positive + a read-isolation gap).
         const dedupThreshold = deps.distillConfig?.dedupCosineThreshold ?? 0.92;
         // The SessionKey only carries the tenant filter into search(); userId and
         // channelId are required-by-type fields the adapter does NOT consume here.
@@ -174,19 +174,19 @@ export async function runDistillationPassAfterTurn(params) {
             id: entryId,
             tenantId: scope.tenantId,
             agentId: scope.agentId,
-            userId: scope.tenantId, // distillation writes at the tenant scope (§14)
+            userId: scope.tenantId, // distillation writes at the tenant scope (deliberate: not per-user)
             content,
-            trustLevel: "learned", // LOCKED: §14 decision 2
-            memoryType: "episodic", // LOCKED: §14 decision 2
+            trustLevel: "learned", // LOCKED: distilled rows always carry learned trust
+            memoryType: "episodic", // LOCKED: distilled rows are always episodic
             source: {
                 who: "lcd_distillation",
                 sessionKey: scope.sessionKey,
             },
-            // The summary:<id> tag (Phase 173, DIST-03 carry-in) keys the recall
+            // The summary:<id> tag keys the recall
             // provenance pass's PROVENANCE-PRECISE branch (recall-provenance.ts:88,
             // SUMMARY_TAG_PREFIX="summary:") so it can query getProvenanceForSummary for
             // the EXACT linked memoryIds this distilled summary subsumes. It adds an id
-            // only — NO content (Security Domain V8).
+            // only — NO content ever rides in a tag.
             tags: ["lcd_distilled", `depth:${depth}`, `summary:${summaryId}`],
             createdAt: now,
         });
@@ -204,7 +204,7 @@ export async function runDistillationPassAfterTurn(params) {
         // STEP 10: EMBED — fire-and-forget (non-blocking; the embedding queue retries).
         deps.embeddingEnqueue?.(entryId, content);
         // STEP 11: PROVENANCE — link the distilled memory to its LCD source summary.
-        // Optional method gate (172-03 adds the concrete SQL impl; 172-02 calls via ?.).
+        // Optional method gate — the concrete SQL impl is daemon-wired and may be absent.
         const provenanceInput = {
             provenanceId: randomUUID(),
             memoryId: entryId,
@@ -216,7 +216,7 @@ export async function runDistillationPassAfterTurn(params) {
             createdAt: now,
         };
         if (deps.lcdStore.appendProvenance == null) {
-            // WR-03: a write occurred but provenance cannot be linked (a realistic
+            // A write occurred but provenance cannot be linked (a realistic
             // partial-wire: memoryPort present, appendProvenance not implemented). Do
             // NOT silently optional-chain past it — surface it so an operator can see
             // the distilled memory has no provenance row (recall down-weighting will be
@@ -237,7 +237,7 @@ export async function runDistillationPassAfterTurn(params) {
         // the new distilled memory (pyramid rule). Do NOT walk the rootSummaryId
         // itself — only its descendants. See markDescendantsSuperseded below.
         await markDescendantsSuperseded(summaryId, entryId, scope, deps);
-        // STEP 13: completion. WR-03: an INFO line carrying durationMs (the §2.7
+        // STEP 13: completion — an INFO line carrying durationMs (the §2.7
         // boundary-completion requirement) — content-free, ids/depth only — PLUS the
         // bus event. durationMs is from the injected clock (nowFn); 0 when no clock
         // callable was injected (timing degrades, never Date.now()).
@@ -260,7 +260,7 @@ export async function runDistillationPassAfterTurn(params) {
         });
     }
     catch (err) {
-        // Non-fatal (T-130-07): any failure degrades to a WARN + return — the live
+        // Non-fatal: any failure degrades to a WARN + return — the live
         // turn is NEVER affected. errorKind "dependency" (store/queue failure).
         deps.logger.warn({
             err: err instanceof Error ? err.message : String(err),
@@ -285,7 +285,7 @@ export async function runDistillationPassAfterTurn(params) {
  * try/catch in runDistillationPassAfterTurn.
  */
 async function markDescendantsSuperseded(rootSummaryId, supersededByMemoryId, scope, deps) {
-    // WR-05 (Phase 173-05): mirror the appendProvenance sibling (~STEP 11) — do NOT
+    // Mirror the appendProvenance sibling (STEP 11) — do NOT
     // silently optional-chain past a missing markProvenanceSuperseded. Branch on
     // `== null` ONCE (the method ref is stable) and emit a content-free DEBUG so a
     // realistic partial-wire (appendProvenance present, markProvenanceSuperseded not)
@@ -317,8 +317,8 @@ async function markDescendantsSuperseded(rootSummaryId, supersededByMemoryId, sc
         // getSummaryChildren is synchronous (better-sqlite3).
         const children = deps.lcdStore.getSummaryChildren(scope, id);
         for (const child of children) {
-            // WR-01: thread scope.tenantId/agentId — the UPDATE is R4-scoped fail-closed.
-            // markFn is proven non-null above (WR-05), so no optional-chain here.
+            // Thread scope.tenantId/agentId — the UPDATE is tenant+agent-scoped fail-closed.
+            // markFn is proven non-null above, so no optional-chain here.
             markFn(child.summaryId, supersededByMemoryId, scope.tenantId, scope.agentId);
             queue.push(child.summaryId);
         }

package/node_modules/@comis/agent/dist/executor/lcd-ingest.d.ts

@@ -1,5 +1,5 @@
 /**
- * LCD afterTurn ingest write-path (Phase 128 dag-mode, A1).
+ * LCD afterTurn ingest write-path (dag mode).
  *
  * Appends a turn's NEW messages to the injected LCD `ContextStorePort` at the
  * `postExecution` (afterTurn) boundary. Extracted into its own module because
@@ -12,18 +12,19 @@
  *      is wrapped per-entry (try/catch + log); the caller gates on
  *      `deps.contextStore` presence so a missing store skips cleanly.
  *   2. AGENT-SIDE TOKENS: `tokenCount` is computed here via
- *      `estimateMessageTokens` (which counts the F3 `thinking` block) — the
- *      store NEVER computes tokens (the 127 contract keeps core/memory free of
+ *      `estimateMessageTokens` (which counts the `thinking` block) — the
+ *      store NEVER computes tokens (the contract keeps core/memory free of
  *      the agent estimator dependency).
  *   3. VERBATIM PARTS: `parts` come from the core `messageToParts` codec
  *      (verbatim `metadata.raw` blocks + envelope) — NEVER flatten a
- *      `tool_use`/`tool_result` to text (the deleted dag-assembler loop bug).
+ *      `tool_use`/`tool_result` to text (flattening loses the stable id and
+ *      breaks tool-result pairing on read-back).
  *
  * Idempotency is the CALLER's responsibility: it derives `startSeq` from the
  * store's persisted count and passes ONLY the not-yet-persisted delta. This
  * helper appends exactly `messages.length` rows starting at `startSeq`; an
  * empty delta appends nothing. The store's unique index on `(conversationId,
- * seq)` is the final guard against a duplicate seq (T-128-09).
+ * seq)` is the final guard against a duplicate seq.
  *
  * Architecture cut (agent↛memory): this module imports ONLY the CORE
  * `ContextStorePort`/`ContextStoreScope` TYPES + the core `messageToParts`
@@ -36,21 +37,20 @@ import type { ContextStorePort, ContextStoreScope, ComisLogger } from "@comis/co
 import type { AgentMessage } from "@earendil-works/pi-agent-core";
 export declare function ingestTurn(store: ContextStorePort, scope: ContextStoreScope, startSeq: number, messages: AgentMessage[], now: number, logger: ComisLogger): void;
 /**
- * R3 (132-04) fail-closed rollover predicate: is `scope` safe to ingest a turn
+ * Fail-closed rollover predicate: is `scope` safe to ingest a turn
  * under, or is it ambiguous/malformed and must REFUSE the write?
  *
- * LOSSLESS-CLAW §5 posture: an ambiguous session rollover fails CLOSED — it
+ * Fail-closed posture: an ambiguous session rollover fails CLOSED — it
  * refuses the write rather than silently reattaching a turn's messages to the
- * WRONG (prior) conversation (the silent cross-session-merge threat,
- * T-132-04-02). This is the ambiguity guard the codebase lacked: today a
- * malformed scope's append proceeds and stamps cross-session-readable / mis-
- * attached rows.
+ * WRONG (prior) conversation (the silent cross-session-merge threat).
+ * Without this ambiguity guard, a malformed scope's append would proceed and
+ * stamp cross-session-readable / mis-attached rows.
  *
  * Two refusal conditions (conservative — refuse, never guess):
  *  1. **Empty/blank security column.** Each of conversationId / agentId /
- *     tenantId / sessionKey MUST be a non-empty TRIMMED string (mirrors the
- *     T-128-08 "SECURITY columns must never be empty" intent + the
- *     {@link ingestTurnGuarded} WR-01 skip+WARN shape). An empty column produces
+ *     tenantId / sessionKey MUST be a non-empty TRIMMED string (SECURITY
+ *     columns must never be empty; mirrors the
+ *     {@link ingestTurnGuarded} shrink-guard skip+WARN shape). An empty column produces
  *     a row reachable by an unrelated scope.
  *  2. **conversationId ↔ sessionKey conflict.** The codebase invariant is
  *     `conversationId === sessionKey === formattedKey`
@@ -70,7 +70,7 @@ export declare function isScopeSafeForIngest(scope: ContextStoreScope): {
     reason: string;
 };
 /**
- * RR1: Derive a stable epoch anchor string from the identity of the first message
+ * Derive a stable epoch anchor string from the identity of the first message
  * in the live array. Used to detect JSONL re-bases (the live transcript re-starting
  * from a fresh disjoint session).
  *
@@ -92,17 +92,17 @@ export declare function messageEpochAnchor(msg: AgentMessage): string;
  * 1. **New epoch** (live[0] anchor differs from stored cursor, or no cursor yet):
  *    The live transcript re-based (JSONL deleted/re-created). Anchor at the
  *    store's current max seq and append the entire new live array as a
- *    continuation (RR2 — close the ~39-message gap). Emits onRebase("session_rebase").
+ *    continuation (closing the re-base gap). Emits onRebase("session_rebase").
  *
  * 2. **Genuine in-session shrink** (same anchor, live.length < cursor.ingestedLiveLen):
  *    A real heal/compaction shrank state.messages within the same epoch. SKIP +
- *    WARN (the original WR-01 fail-safe — unchanged). Emits onDivergence.
+ *    WARN (the original shrink fail-safe — unchanged). Emits onDivergence.
  *
  * 3. **Steady state** (same anchor, live grows monotonically): delta =
- *    live.slice(ingestedLiveLen). Byte-identical to the pre-patch path when
- *    ingestedLiveLen === persisted (RR3 keystone).
+ *    live.slice(ingestedLiveLen). Byte-identical to the plain
+ *    live.slice(persisted) path when ingestedLiveLen === persisted.
  *
- * Also refuses writes on an ambiguous/malformed scope (R3 fail-closed rollover —
+ * Also refuses writes on an ambiguous/malformed scope (fail-closed rollover —
  * see {@link isScopeSafeForIngest}).
  *
  * ATOMICITY: `upsertIngestCursor` is called inside the same `store.runOnConversation`
@@ -114,14 +114,14 @@ export declare function messageEpochAnchor(msg: AgentMessage): string;
  * @param live         The live canonical AgentMessage[] (the full conversation).
  * @param now          Injected wall-clock ms (`deps.clock.now()`).
  * @param logger       For the divergence WARN + the delegated ingest logs.
- * @param onFailClosed Optional callback fired ONLY on the R3 fail-closed-rollover
+ * @param onFailClosed Optional callback fired ONLY on the fail-closed-rollover
  *                     refuse path, carrying the refusal `reason`. Never carries
  *                     message content; keeps this module bus-free.
- * @param onDivergence Optional callback fired ONLY on the WR-01 genuine in-session
+ * @param onDivergence Optional callback fired ONLY on the genuine in-session
  *                     shrink skip, carrying `"live_store_divergence"`. Never carries
  *                     message content.
  * @param onRebase     Optional callback fired ONLY on an epoch re-base continuation,
- *                     carrying `"session_rebase"`. RR6: INFO signal (correct continuation,
+ *                     carrying `"session_rebase"`. An INFO signal (correct continuation,
  *                     not degradation). Never carries message content.
  */
 export declare function ingestTurnGuarded(store: ContextStorePort, scope: ContextStoreScope, live: AgentMessage[], now: number, logger: ComisLogger, onFailClosed?: (reason: string) => void, onDivergence?: (reason: string) => void, onRebase?: (reason: string) => void): void;