comisai 1.0.45 → 1.0.46

package/node_modules/@comis/core/dist/security/tool-capability-map.js

@@ -1,16 +1,19 @@
 import { SUB_AGENT_TOOL_DENYLIST } from "../domain/sub-agent-tool-denylist.js";
 /**
  * Tool name → required {@link AgentCapability}. The curated allow-list: a tool
- * absent from this map has NO capability and is undispatchable (DISPATCH-02 —
- * default-deny by absence). `as const satisfies Record<string, AgentCapability>`
+ * absent from this map has NO capability and is undispatchable
+ * (default-deny by absence). `as const satisfies Record<string, AgentCapability>`
  * keeps the literal cap strings exact at the type level (the no-typo'd-cap
  * invariant) while typing the whole table.
  *
- * SCOPE: the §3.6 read/web surface only — `orch:read` (RPC-backed reads +
- * in-process workspace builtins) and `orch:web` (daemon-side, DNS-pinned).
- * Admin/management tools (`mcp_manage`, `gateway`, `agents_create`, …) are
- * NEVER mapped: they stay unreachable via this curated surface, and the
- * deny-by-origin chokepoint covers the control plane.
+ * SCOPE: the read/web + inbound-MCP + workspace-write surface — `orch:read`
+ * (RPC-backed reads + in-process workspace builtins), `orch:web` (daemon-side,
+ * DNS-pinned), `orch:mcp` (the fixed-literal connected-MCP-server call), and
+ * `orch:write` (the run-scoped, run-ephemeral `results/writes` write core, whose
+ * typed SURFACE is default-off behind the `autonomy.write` opt-in). Admin/
+ * management tools (`mcp_manage`, `gateway`, `agents_create`, …) are NEVER
+ * mapped: they stay unreachable via this curated surface, and the deny-by-origin
+ * chokepoint covers the control plane.
  */
 export const TOOL_CAPABILITY_MAP = {
     // orch:read — RPC-backed reads (route → an existing registered handler)
@@ -27,7 +30,7 @@ export const TOOL_CAPABILITY_MAP = {
     find: "orch:read",
     ls: "orch:read",
     jq: "orch:read",
-    // orch:read — the full ResultRef query engine (QRY-01/02): DuckDB-SQL over
+    // orch:read — the full ResultRef query engine: DuckDB-SQL over
     // CSV/JSONL + JSONPath over JSON, run DAEMON-side (like jq) over the
     // run-scoped results/ file; only the slice re-enters context. Read-only —
     // the daemon-side DuckDB is CONFINED to the run's workspace
@@ -36,12 +39,43 @@ export const TOOL_CAPABILITY_MAP = {
     // (--readonly :memory:, no autoload, INSTALL/LOAD/ATTACH/COPY/EXPORT, the
     // pure-exfil readers read_text/read_blob/glob/getenv, and url-readers
     // rejected before spawn) so this cap can never read a host file outside the
-    // workspace or become an SSRF/exfil egress (T-221-QRY-01..06 / CR-01).
+    // workspace or become an SSRF/exfil egress.
     sql: "orch:read",
     jsonpath: "orch:read",
     // orch:web — daemon-side, DNS-pinned (the jail stays --unshare-net)
     web_search: "orch:web",
     web_fetch: "orch:web",
+    // orch:mcp — daemon-side connected-MCP-server call (the jail stays
+    // --unshare-net; the net call runs daemon-side like web_fetch). The wire tool
+    // name is the fixed literal "mcp"; the dynamic {server,tool} ride inside args
+    // (validated at the executor allowlist), so ONE entry governs the whole
+    // runtime-dynamic namespace — MCP tools are never enumerated into this map.
+    mcp: "orch:mcp",
+    // orch:write — daemon-side workspace mutation, the FIRST mutating builtin. A
+    // MINIMAL, run-EPHEMERAL write confined to a RUN-SCOPED subdir
+    // (<workspace>/results/writes) via safePath: results/ is reaped wholesale by
+    // ResultRefStore.cleanupRun on run end, so the write is genuinely ephemeral AND
+    // isolated from the workspace-root discovery/config subtrees (skills/,
+    // .learned-skills/, memory, config) — NOT the persistent workspace root, NOT an
+    // arbitrary/absolute path. Gated by requireCapability(orch:write) at the
+    // endpoint AND — because orch:write is a FLOOR cap in standard+ — the typed
+    // write SURFACE is default-OFF behind an explicit per-agent opt-in
+    // (autonomy.write), enforced in the executor's writeSurfaceEnabled gate. So a
+    // default standard agent HOLDS orch:write yet cannot reach the write tool.
+    write: "orch:write",
+    // orch:write / orch:read — the durable specialized checkpoint/resume pair
+    // (RESUME-01). checkpoint persists a distinguished, longer-TTL kind:"json"
+    // ResultRef (the run's last state) and stamps its id onto the durable row;
+    // resume reads that state back WRAPPED (data-not-control). They REUSE the FLOOR
+    // caps (checkpoint→orch:write, resume→orch:read) rather than a new
+    // orch:checkpoint cap — the authoritative gate is NOT the cap (both are floor
+    // caps held in standard+) but the daemon-side `orchestrateResumeEnabled` surface
+    // predicate (default-off `autonomy.durability.orchestrateResume`), mirroring how
+    // `write` sits behind `autonomy.write`. Reusing floor caps avoids the 5-consumer
+    // AGENT_CAPABILITIES fan-out + capability-scope-disjoint churn a bespoke cap
+    // would force, and keeps the durability toggle the single authoritative gate.
+    checkpoint: "orch:write",
+    resume: "orch:read",
 };
 /**
  * Tool name → dispatch route. Every {@link ToolName} has exactly one entry (the
@@ -51,8 +85,8 @@ export const TOOL_CAPABILITY_MAP = {
  *     read (contract `api-contracts/sessions.ts:110`, classified `ungated` at
  *     `handler-capability-map.ts:81`, implemented in `session-handlers/session-read.ts`).
  *   - `session.get` is NOT registered (only `action-classifier.ts` + a test
- *     mock) — routing to it would 404 at the sink's `!handler` throw
- *     (Gap 1 / T-212-03). Do NOT route a builtin via `{kind:"rpc"}`.
+ *     mock) — routing to it would 404 at the sink's `!handler` throw.
+ *     Do NOT route a builtin via `{kind:"rpc"}`.
  */
 export const TOOL_ROUTE_MAP = {
     memory_search: { kind: "rpc", method: "memory.search_files" },
@@ -71,16 +105,23 @@ export const TOOL_ROUTE_MAP = {
     jsonpath: { kind: "executor" },
     web_search: { kind: "executor" },
     web_fetch: { kind: "executor" },
+    mcp: { kind: "executor" },
+    write: { kind: "executor" }, // workspace-confined write core (mirrors the file builtins)
+    // The durable checkpoint/resume pair runs DAEMON-side (longer-TTL materialize +
+    // durable-row checkpointRef read/write, wrap-on-read) — an in-process executor
+    // arm, NOT an RPC method. Same route kind as write / the file builtins.
+    checkpoint: { kind: "executor" },
+    resume: { kind: "executor" },
 };
 // ---------------------------------------------------------------------------
-// Module-load soundness assertions (DISPATCH-03 + route completeness).
+// Module-load soundness assertions (denylist disjointness + route completeness).
 // Mirrors handler-capability-map.ts's discipline + setup-capability-endpoint.ts:171-177:
 // assert-at-load so a denylist rename or a missing route fails LOUD at import,
 // not silently at the VPS. The arch-tests pin the same invariants at build time.
 // ---------------------------------------------------------------------------
 /**
- * Assert the cap-map ↔ denylist ↔ route-map soundness invariants (DISPATCH-03 +
- * route completeness). Pure: takes the three tables explicitly so the invariant
+ * Assert the cap-map ↔ denylist ↔ route-map soundness invariants (denylist
+ * disjointness + route completeness). Pure: takes the three tables explicitly so the invariant
  * is independently unit-testable over a poisoned copy (the throw branches are
  * the security fail-loud paths — they MUST be covered). Throws a descriptive
  * `Error` on the first violation.

package/node_modules/@comis/core/dist/security/validate-learned-doc-body.d.ts

@@ -1,28 +1,25 @@
 /**
  * validateLearnedDocBody — the STATIC poison/secret scan that is ALL the validation
- * an advisory Mental Model doc receives before it crosses into durable storage
- * (D-06 / SKILL-02 / INV-3).
+ * an advisory Mental Model doc receives before it crosses into durable storage.
  *
- * It is the extracted, renamed STATIC half of the old sandbox adapter's `scanFields`
- * (packages/skills/src/learning/sandbox-skill-validation-adapter.ts): each untrusted
- * text field (`name` / `body` / `description`) is run through the
+ * Each untrusted text field (`name` / `body` / `description`) is run through the
  * {@link validateMemoryWrite} keystone, and a CRITICAL on ANY field rejects the doc
- * (the memory-poison `injection-trajectory` + secret-egress defenses, T-223-04). A
+ * (the memory-poison `injection-trajectory` + secret-egress defenses). A
  * `warn` severity is benign — the keystone records it but it NEVER rejects (severity
  * is a classification, never coerced to a boolean). The attacker-influenced `name`
  * (LLM output distilled from an UNTRUSTED transcript) is ALSO length-bounded to
  * reject a megabyte-name DoS before the scan runs over it.
  *
- * STATIC-ONLY by construction (SKILL-02 / INV-3): an advisory doc carries no embedded
- * procedure (that column was dropped in Phase 222), no parameter schema, no tool
- * policy and no dynamic-replay surface — so this function has none of that. There is
- * no process execution, no sandbox, and no skills-package import; the
- * learned-code-execution attack surface is removed entirely (T-223-05). It depends
- * ONLY on `validateMemoryWrite`, which already lives in @comis/core — the
- * simplification-true placement that lets the agent reflection job (Plan 04) call it
- * directly and lets the daemon reflect bundle shed its skills-package dependency.
+ * STATIC-ONLY by construction: an advisory doc carries no embedded procedure,
+ * no parameter schema, no tool policy and no dynamic-replay surface — so this
+ * function has none of that. There is no process execution, no sandbox, and no
+ * skills-package import; the learned-code-execution attack surface is removed
+ * entirely. It depends ONLY on `validateMemoryWrite`, which already lives in
+ * @comis/core — a placement that lets the agent reflection job call it
+ * directly and keeps the daemon reflect bundle free of a skills-package
+ * dependency.
  *
- * Privacy (T-223-06): a finding carries the field name + pattern NAMES /
+ * Privacy: a finding carries the field name + pattern NAMES /
  * `criticalPatterns` labels (e.g. `secret-egress-guard`) — NEVER the matched secret
  * value or the offending body text. This is the existing `validateMemoryWrite`
  * contract, unchanged.
@@ -30,8 +27,8 @@
  * @module validate-learned-doc-body
  */
 /**
- * The maximum char length allowed for a learned-doc `name` (was
- * `MAX_SKILL_NAME_LENGTH`). `name` is attacker-influenced (LLM output distilled from
+ * The maximum char length allowed for a learned-doc `name`.
+ * `name` is attacker-influenced (LLM output distilled from
  * an UNTRUSTED transcript) and flows into durable storage / lookup keys / prompts, so
  * a sane ceiling rejects a megabyte-name DoS at validation. 120 chars matches the
  * prompt's "short, stable, kebab-case" instruction.
@@ -56,8 +53,7 @@ export interface LearnedDocValidation {
  * `description`. A CRITICAL on ANY field (a DANGEROUS_COMMAND_PATTERN or a
  * secret-egress hit) ⇒ reject; an over-cap `name` ⇒ reject. A `warn` is recorded by
  * the keystone but never rejects. No embedded procedure, no parameter schema, no tool
- * policy, no dynamic replay — this is the entire validation an advisory doc receives
- * (SKILL-02 / INV-3).
+ * policy, no dynamic replay — this is the entire validation an advisory doc receives.
  *
  * @param doc - the candidate advisory doc (untrusted, LLM-distilled).
  * @returns `{ ok, findings }` — `ok:false` with per-field findings on any rejection.

package/node_modules/@comis/core/dist/security/validate-learned-doc-body.js

@@ -1,29 +1,26 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
  * validateLearnedDocBody — the STATIC poison/secret scan that is ALL the validation
- * an advisory Mental Model doc receives before it crosses into durable storage
- * (D-06 / SKILL-02 / INV-3).
+ * an advisory Mental Model doc receives before it crosses into durable storage.
  *
- * It is the extracted, renamed STATIC half of the old sandbox adapter's `scanFields`
- * (packages/skills/src/learning/sandbox-skill-validation-adapter.ts): each untrusted
- * text field (`name` / `body` / `description`) is run through the
+ * Each untrusted text field (`name` / `body` / `description`) is run through the
  * {@link validateMemoryWrite} keystone, and a CRITICAL on ANY field rejects the doc
- * (the memory-poison `injection-trajectory` + secret-egress defenses, T-223-04). A
+ * (the memory-poison `injection-trajectory` + secret-egress defenses). A
  * `warn` severity is benign — the keystone records it but it NEVER rejects (severity
  * is a classification, never coerced to a boolean). The attacker-influenced `name`
  * (LLM output distilled from an UNTRUSTED transcript) is ALSO length-bounded to
  * reject a megabyte-name DoS before the scan runs over it.
  *
- * STATIC-ONLY by construction (SKILL-02 / INV-3): an advisory doc carries no embedded
- * procedure (that column was dropped in Phase 222), no parameter schema, no tool
- * policy and no dynamic-replay surface — so this function has none of that. There is
- * no process execution, no sandbox, and no skills-package import; the
- * learned-code-execution attack surface is removed entirely (T-223-05). It depends
- * ONLY on `validateMemoryWrite`, which already lives in @comis/core — the
- * simplification-true placement that lets the agent reflection job (Plan 04) call it
- * directly and lets the daemon reflect bundle shed its skills-package dependency.
+ * STATIC-ONLY by construction: an advisory doc carries no embedded procedure,
+ * no parameter schema, no tool policy and no dynamic-replay surface — so this
+ * function has none of that. There is no process execution, no sandbox, and no
+ * skills-package import; the learned-code-execution attack surface is removed
+ * entirely. It depends ONLY on `validateMemoryWrite`, which already lives in
+ * @comis/core — a placement that lets the agent reflection job call it
+ * directly and keeps the daemon reflect bundle free of a skills-package
+ * dependency.
  *
- * Privacy (T-223-06): a finding carries the field name + pattern NAMES /
+ * Privacy: a finding carries the field name + pattern NAMES /
  * `criticalPatterns` labels (e.g. `secret-egress-guard`) — NEVER the matched secret
  * value or the offending body text. This is the existing `validateMemoryWrite`
  * contract, unchanged.
@@ -32,8 +29,8 @@
  */
 import { validateMemoryWrite } from "./memory-write-validator.js";
 /**
- * The maximum char length allowed for a learned-doc `name` (was
- * `MAX_SKILL_NAME_LENGTH`). `name` is attacker-influenced (LLM output distilled from
+ * The maximum char length allowed for a learned-doc `name`.
+ * `name` is attacker-influenced (LLM output distilled from
  * an UNTRUSTED transcript) and flows into durable storage / lookup keys / prompts, so
  * a sane ceiling rejects a megabyte-name DoS at validation. 120 chars matches the
  * prompt's "short, stable, kebab-case" instruction.
@@ -44,8 +41,7 @@ export const MAX_DOC_NAME_LENGTH = 120;
  * `description`. A CRITICAL on ANY field (a DANGEROUS_COMMAND_PATTERN or a
  * secret-egress hit) ⇒ reject; an over-cap `name` ⇒ reject. A `warn` is recorded by
  * the keystone but never rejects. No embedded procedure, no parameter schema, no tool
- * policy, no dynamic replay — this is the entire validation an advisory doc receives
- * (SKILL-02 / INV-3).
+ * policy, no dynamic replay — this is the entire validation an advisory doc receives.
  *
  * @param doc - the candidate advisory doc (untrusted, LLM-distilled).
  * @returns `{ ok, findings }` — `ok:false` with per-field findings on any rejection.

package/node_modules/@comis/core/dist/text/generation-quality.d.ts

@@ -1,19 +1,20 @@
 /**
- * GENQ-01: the pure, single-source (I7) generation-quality classifier.
+ * The pure, single-source generation-quality classifier.
  *
- * Generalizes the v2.22 OBS-01 `dominantScript(source) vs dominantScript(output)`
+ * Generalizes the `dominantScript(source) vs dominantScript(output)`
  * check — which the context-engine summary path already runs to emit
  * `context:summary_language_mismatch` — into one shared classifier consumed by
  * EVERY memory-generation pass (consolidation, reasoning, user-representation).
  * A weak local model that silently translates non-Latin source memories into a
- * Latin output (F-ML1: the user-representation pass translated Hebrew facts into
- * an English profile, found offline not via obs) becomes a counted fleet signal.
+ * Latin output (e.g. a user-representation pass translating Hebrew facts into
+ * an English profile — a failure otherwise invisible to observability) becomes
+ * a counted fleet signal.
  *
- * VISIBILITY ONLY — pure function, NO gating, no rejection (the v2.22 §8 REJECT:
- * a mixed code-heavy chunk legitimately skews Latin via the 0.3 dominance
- * threshold in `dominantScript`, so a rejection rule over-fires). NO imports from
+ * VISIBILITY ONLY — pure function, NO gating, no rejection (a mixed code-heavy
+ * chunk legitimately skews Latin via the 0.3 dominance threshold in
+ * `dominantScript`, so a rejection rule would over-fire). NO imports from
  * any @comis package beyond the pure `dominantScript` data table; no I/O, clock,
- * or env (I9). Reads the text locally and returns enums/booleans — nothing leaks.
+ * or env. Reads the text locally and returns enums/booleans — nothing leaks.
  * @module
  */
 import { type ScriptClass } from "./script-classes.js";
@@ -25,7 +26,7 @@ export interface GenerationQualityClassification {
     readonly sourceScript: ScriptClass;
     /** Dominant script of the generated OUTPUT. */
     readonly outputScript: ScriptClass;
-    /** A non-Latin source whose output came back Latin (the F-ML1 regression class).
+    /** A non-Latin source whose output came back Latin (the silent-translation regression class).
      *  False whenever the output is empty — `emptyOutput` owns that case. */
     readonly languageMismatch: boolean;
     /** The output is empty / whitespace-only (the pass produced nothing usable). */
@@ -33,7 +34,7 @@ export interface GenerationQualityClassification {
 }
 /**
  * Classify one generation pass's (source, output) text pair. Two O(n)
- * `dominantScript` passes (SCRIPT-01) plus a trim. Pure and deterministic:
+ * `dominantScript` passes plus a trim. Pure and deterministic:
  * the same pair always yields the same result.
  *
  * `languageMismatch` mirrors the summary detector's predictable small-model

package/node_modules/@comis/core/dist/text/generation-quality.js

@@ -1,26 +1,27 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * GENQ-01: the pure, single-source (I7) generation-quality classifier.
+ * The pure, single-source generation-quality classifier.
  *
- * Generalizes the v2.22 OBS-01 `dominantScript(source) vs dominantScript(output)`
+ * Generalizes the `dominantScript(source) vs dominantScript(output)`
  * check — which the context-engine summary path already runs to emit
  * `context:summary_language_mismatch` — into one shared classifier consumed by
  * EVERY memory-generation pass (consolidation, reasoning, user-representation).
  * A weak local model that silently translates non-Latin source memories into a
- * Latin output (F-ML1: the user-representation pass translated Hebrew facts into
- * an English profile, found offline not via obs) becomes a counted fleet signal.
+ * Latin output (e.g. a user-representation pass translating Hebrew facts into
+ * an English profile — a failure otherwise invisible to observability) becomes
+ * a counted fleet signal.
  *
- * VISIBILITY ONLY — pure function, NO gating, no rejection (the v2.22 §8 REJECT:
- * a mixed code-heavy chunk legitimately skews Latin via the 0.3 dominance
- * threshold in `dominantScript`, so a rejection rule over-fires). NO imports from
+ * VISIBILITY ONLY — pure function, NO gating, no rejection (a mixed code-heavy
+ * chunk legitimately skews Latin via the 0.3 dominance threshold in
+ * `dominantScript`, so a rejection rule would over-fire). NO imports from
  * any @comis package beyond the pure `dominantScript` data table; no I/O, clock,
- * or env (I9). Reads the text locally and returns enums/booleans — nothing leaks.
+ * or env. Reads the text locally and returns enums/booleans — nothing leaks.
  * @module
  */
 import { dominantScript } from "./script-classes.js";
 /**
  * Classify one generation pass's (source, output) text pair. Two O(n)
- * `dominantScript` passes (SCRIPT-01) plus a trim. Pure and deterministic:
+ * `dominantScript` passes plus a trim. Pure and deterministic:
  * the same pair always yields the same result.
  *
  * `languageMismatch` mirrors the summary detector's predictable small-model

package/node_modules/@comis/core/dist/text/multilingual-heuristic.d.ts

@@ -1,10 +1,10 @@
 /**
- * EMB-01 name heuristic (advisory-only, I4). Pure: no I/O/clock/env (I9).
+ * Multilingual model-name heuristic (advisory-only). Pure: no I/O/clock/env.
  *
  * Classifies an embedder / reranker model id as `true | false | "unknown"` for
  * the `comis fleet` model-health line, so a degraded non-Latin semantic-recall
  * stack (an English-leaning embedder/reranker) is named in one fleet look. The
- * result NEVER gates search/recall behavior — the FTS trigram floor (Phase 180)
+ * result NEVER gates search/recall behavior — the FTS trigram floor
  * carries recall regardless. Imported by the daemon boot wiring (daemon.ts:1581).
  *
  * @module
@@ -14,18 +14,18 @@
  * family: `bge-m3`, `multilingual-e5` — matched via the `multilingual` token —
  * `m3e`, `LaBSE`).
  *
- * WR-01 FIX: the design's bare `e5` alternation was unanchored and matched as a
- * substring anywhere, so English-only E5 ids (`intfloat/e5-large-v2`) and
- * incidental `type5`/`base5` slugs FALSE-POSITIVED to `true`. A false positive
+ * A bare `e5` alternation is deliberately absent: unanchored, it would match as
+ * a substring anywhere, so English-only E5 ids (`intfloat/e5-large-v2`) and
+ * incidental `type5`/`base5` slugs would FALSE-POSITIVE to `true`. A false positive
  * SUPPRESSES the `model_health:embedder_not_multilingual` advisory — the harmful
- * direction, hiding the exact non-Latin degradation EMB-01 exists to surface. We
- * drop the bare `e5` token and rely on `multilingual` (which already matches the
+ * direction, hiding the exact non-Latin degradation this heuristic exists to
+ * surface. We rely on `multilingual` (which already matches the
  * `multilingual-e5-*` family); a false NEGATIVE degrades safely to `"unknown"`,
  * which still fires the advisory.
  */
 export declare const EMBED_MULTILINGUAL: RegExp;
 /**
- * Reranker multilingual name pattern. FIX for Pitfall 2: the shipped default
+ * Reranker multilingual name pattern. The shipped default
  * reranker slug is `bge-reranker-v2-m3` (schema-memory.ts:64-66), NOT `bge-m3`,
  * so the embedder literal above FALSE-NEGATIVES it. This pattern matches the
  * `bge-reranker-…m3` family (and the generic multilingual/bge-m3 hints).
@@ -38,10 +38,10 @@ export declare const RERANK_MULTILINGUAL: RegExp;
  *                   `undefined` when undeclared (only the embedder has a config
  *                   flag today; the reranker always passes `undefined`).
  * @param modelId  - the resolved model id string (config-sourced; only `.test()`'d
- *                   against the fixed regex — never executed/interpolated, T-182-05).
+ *                   against the fixed regex — never executed/interpolated).
  * @param re       - EMBED_MULTILINGUAL or RERANK_MULTILINGUAL.
  * @returns `declared` when it is a boolean (explicit config WINS, both directions);
  *          else `true` on a regex hit; else `"unknown"` (honest — `false` is
- *          reserved for an explicit `multilingual: false`, A2 / Open Question 3).
+ *          reserved for an explicit `multilingual: false`).
  */
 export declare function resolveMultilingual(declared: boolean | undefined, modelId: string, re: RegExp): boolean | "unknown";

package/node_modules/@comis/core/dist/text/multilingual-heuristic.js

@@ -1,11 +1,11 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * EMB-01 name heuristic (advisory-only, I4). Pure: no I/O/clock/env (I9).
+ * Multilingual model-name heuristic (advisory-only). Pure: no I/O/clock/env.
  *
  * Classifies an embedder / reranker model id as `true | false | "unknown"` for
  * the `comis fleet` model-health line, so a degraded non-Latin semantic-recall
  * stack (an English-leaning embedder/reranker) is named in one fleet look. The
- * result NEVER gates search/recall behavior — the FTS trigram floor (Phase 180)
+ * result NEVER gates search/recall behavior — the FTS trigram floor
  * carries recall regardless. Imported by the daemon boot wiring (daemon.ts:1581).
  *
  * @module
@@ -15,18 +15,18 @@
  * family: `bge-m3`, `multilingual-e5` — matched via the `multilingual` token —
  * `m3e`, `LaBSE`).
  *
- * WR-01 FIX: the design's bare `e5` alternation was unanchored and matched as a
- * substring anywhere, so English-only E5 ids (`intfloat/e5-large-v2`) and
- * incidental `type5`/`base5` slugs FALSE-POSITIVED to `true`. A false positive
+ * A bare `e5` alternation is deliberately absent: unanchored, it would match as
+ * a substring anywhere, so English-only E5 ids (`intfloat/e5-large-v2`) and
+ * incidental `type5`/`base5` slugs would FALSE-POSITIVE to `true`. A false positive
  * SUPPRESSES the `model_health:embedder_not_multilingual` advisory — the harmful
- * direction, hiding the exact non-Latin degradation EMB-01 exists to surface. We
- * drop the bare `e5` token and rely on `multilingual` (which already matches the
+ * direction, hiding the exact non-Latin degradation this heuristic exists to
+ * surface. We rely on `multilingual` (which already matches the
  * `multilingual-e5-*` family); a false NEGATIVE degrades safely to `"unknown"`,
  * which still fires the advisory.
  */
 export const EMBED_MULTILINGUAL = /multilingual|bge-m3|m3e|labse/i;
 /**
- * Reranker multilingual name pattern. FIX for Pitfall 2: the shipped default
+ * Reranker multilingual name pattern. The shipped default
  * reranker slug is `bge-reranker-v2-m3` (schema-memory.ts:64-66), NOT `bge-m3`,
  * so the embedder literal above FALSE-NEGATIVES it. This pattern matches the
  * `bge-reranker-…m3` family (and the generic multilingual/bge-m3 hints).
@@ -39,11 +39,11 @@ export const RERANK_MULTILINGUAL = /multilingual|bge-reranker-v2-m3|reranker.*m3
  *                   `undefined` when undeclared (only the embedder has a config
  *                   flag today; the reranker always passes `undefined`).
  * @param modelId  - the resolved model id string (config-sourced; only `.test()`'d
- *                   against the fixed regex — never executed/interpolated, T-182-05).
+ *                   against the fixed regex — never executed/interpolated).
  * @param re       - EMBED_MULTILINGUAL or RERANK_MULTILINGUAL.
  * @returns `declared` when it is a boolean (explicit config WINS, both directions);
  *          else `true` on a regex hit; else `"unknown"` (honest — `false` is
- *          reserved for an explicit `multilingual: false`, A2 / Open Question 3).
+ *          reserved for an explicit `multilingual: false`).
  */
 export function resolveMultilingual(declared, modelId, re) {
     if (typeof declared === "boolean")

package/node_modules/@comis/core/dist/text/normalize-search.d.ts

@@ -1,5 +1,5 @@
 /**
- * The ONE search-text normalizer (FTS-02 / I7).
+ * The ONE search-text normalizer.
  *
  * Single source of truth for search-text folding: the twin inserts, the trigram
  * MATCH builder, the bounded scan floor, and the `comis doctor` backfill ALL
@@ -8,8 +8,8 @@
  * folding to medial-kaf forms). Adding a script later is a data edit — append a
  * fold range/map, never a new mechanism.
  *
- * Pipeline order is LOAD-BEARING and probe-verified (RESEARCH Pattern 2 /
- * Code Example 3, live-verified 2026-06-13 against Node 22.21.1):
+ * Pipeline order is LOAD-BEARING (verified against the live Node 22.21.1
+ * Unicode tables):
  *   (1) NFKC          — folds presentation forms (FB1D+/FB50+), full-width, and
  *                       ligatures; a POINTED presentation form (e.g. U+FB2A
  *                       shin-with-shin-dot) decomposes to base + a COMBINING
@@ -24,19 +24,19 @@
  * FORBIDDEN anywhere here — only the COMPOSED form (NFKC) is used. The
  * decomposing form would split ё → е + U+0308 (silently implementing the fold
  * we keep EXPLICIT and breaking the idempotency pins) and destroy Devanagari
- * matras / Thai vowels (RESEARCH Pitfall 7).
+ * matras / Thai vowels.
  *
  * Defined in @comis/core so @comis/memory (twin inserts + both search lanes)
  * and @comis/cli (doctor backfill) import it without a package cycle. NO imports
- * from any @comis package — pure static data + pure functions, no I/O/clock/env
- * (I9), and NO regex (V5 — zero ReDoS surface; every transform is a bounded
+ * from any @comis package — pure static data + pure functions, no I/O/clock/env,
+ * and NO regex (zero ReDoS surface; every transform is a bounded
  * codepoint-range test or a fixed-size map lookup, allocation bounded by the
  * input length, never by backtracking).
  * @module
  */
 /**
- * The ONE search-text normalizer (I7): twin inserts, MATCH builder, scan floor,
- * and doctor backfill all import THIS symbol. Pure (I9): no I/O/clock/env.
+ * The ONE search-text normalizer: twin inserts, MATCH builder, scan floor,
+ * and doctor backfill all import THIS symbol. Pure: no I/O/clock/env.
  *
  * @param text - raw text (a stored message/summary/memory, or a query token).
  * @returns the folded form; index side and query side fold identically.

package/node_modules/@comis/core/dist/text/normalize-search.js

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * The ONE search-text normalizer (FTS-02 / I7).
+ * The ONE search-text normalizer.
  *
  * Single source of truth for search-text folding: the twin inserts, the trigram
  * MATCH builder, the bounded scan floor, and the `comis doctor` backfill ALL
@@ -9,8 +9,8 @@
  * folding to medial-kaf forms). Adding a script later is a data edit — append a
  * fold range/map, never a new mechanism.
  *
- * Pipeline order is LOAD-BEARING and probe-verified (RESEARCH Pattern 2 /
- * Code Example 3, live-verified 2026-06-13 against Node 22.21.1):
+ * Pipeline order is LOAD-BEARING (verified against the live Node 22.21.1
+ * Unicode tables):
  *   (1) NFKC          — folds presentation forms (FB1D+/FB50+), full-width, and
  *                       ligatures; a POINTED presentation form (e.g. U+FB2A
  *                       shin-with-shin-dot) decomposes to base + a COMBINING
@@ -25,12 +25,12 @@
  * FORBIDDEN anywhere here — only the COMPOSED form (NFKC) is used. The
  * decomposing form would split ё → е + U+0308 (silently implementing the fold
  * we keep EXPLICIT and breaking the idempotency pins) and destroy Devanagari
- * matras / Thai vowels (RESEARCH Pitfall 7).
+ * matras / Thai vowels.
  *
  * Defined in @comis/core so @comis/memory (twin inserts + both search lanes)
  * and @comis/cli (doctor backfill) import it without a package cycle. NO imports
- * from any @comis package — pure static data + pure functions, no I/O/clock/env
- * (I9), and NO regex (V5 — zero ReDoS surface; every transform is a bounded
+ * from any @comis package — pure static data + pure functions, no I/O/clock/env,
+ * and NO regex (zero ReDoS surface; every transform is a bounded
  * codepoint-range test or a fixed-size map lookup, allocation bounded by the
  * input length, never by backtracking).
  * @module
@@ -38,7 +38,7 @@
 // ── Hebrew (U+0590 block) ───────────────────────────────────────────────────
 /** True for a Hebrew combining mark to STRIP: cantillation/te'amim + niqqud
  *  points. Includes the dagesh U+05BC that NFKC emits from pointed presentation
- *  forms (it sits inside the U+0591–05BD run). Probe 2026-06-13. */
+ *  forms (it sits inside the U+0591–05BD run). */
 function isHebrewMark(cp) {
     return ((cp >= 0x0591 && cp <= 0x05bd) || // cantillation marks + points through meteg (incl. dagesh 05BC)
         cp === 0x05bf || // rafe
@@ -47,8 +47,7 @@ function isHebrewMark(cp) {
     );
 }
 /** Final-form Hebrew letters → their medial form. A word-final letter and its
- *  medial twin must fold to the SAME trigram so `מלך` co-matches `מלכים`
- *  (RESEARCH Pitfall 5). Probe 2026-06-13. */
+ *  medial twin must fold to the SAME trigram so `מלך` co-matches `מלכים`. */
 const HEBREW_FINALS = new Map([
     [0x05da, 0x05db], // ך → כ  final kaf
     [0x05dd, 0x05de], // ם → מ  final mem
@@ -63,7 +62,7 @@ function isHebrewLetter(cp) {
 }
 /** Acronym quote stand-ins deleted ONLY when Hebrew-flanked on BOTH sides:
  *  geresh/gershayim + the smart/ASCII quotes mobile keyboards substitute.
- *  `צה"ל` (any stand-in) folds to `צהל`. Probe 2026-06-13. */
+ *  `צה"ל` (any stand-in) folds to `צהל`. */
 function isHebrewAcronymQuote(cp) {
     return (cp === 0x05f3 || // ׳ geresh
         cp === 0x05f4 || // ״ gershayim
@@ -82,7 +81,7 @@ function isArabicMark(cp) {
 }
 /** Arabic letter folds: hamza-carriers → bare alef; alef-maksura → yeh;
  *  ta-marbuta → heh. Each unifies an orthographic variant of the SAME word
- *  (`أحمد` ≡ `احمد`). Probe 2026-06-13. */
+ *  (`أحمد` ≡ `احمد`). */
 const ARABIC_LETTER_FOLDS = new Map([
     [0x0623, 0x0627], // أ → ا  hamza-on-alef
     [0x0625, 0x0627], // إ → ا  hamza-below-alef
@@ -102,14 +101,14 @@ function arabicDigitToAscii(cp) {
 }
 // ── Cyrillic ──────────────────────────────────────────────────────────────────
 // ё → е (U+0451 → U+0435) ONLY. Applied post-lowercase, so Ё (U+0401) is
-// already ё by the time we get here. NEVER fold й → и (RESEARCH §Pattern 2 /
-// Probe 2026-06-13) — they are distinct letters.
+// already ё by the time we get here. NEVER fold й → и — they are distinct
+// letters.
 const CYRILLIC_YO = 0x0451; // ё
 const CYRILLIC_YE = 0x0435; // е
 const TATWEEL = 0x0640; // ـ Arabic kashida — deleted entirely
 /**
- * The ONE search-text normalizer (I7): twin inserts, MATCH builder, scan floor,
- * and doctor backfill all import THIS symbol. Pure (I9): no I/O/clock/env.
+ * The ONE search-text normalizer: twin inserts, MATCH builder, scan floor,
+ * and doctor backfill all import THIS symbol. Pure: no I/O/clock/env.
  *
  * @param text - raw text (a stored message/summary/memory, or a query token).
  * @returns the folded form; index side and query side fold identically.

package/node_modules/@comis/core/dist/text/script-classes.d.ts

@@ -3,16 +3,16 @@
  * classifier functions over it (classifyCodepointToRow, classifyCodepoint,
  * scriptShares, dominantScript).
  *
- * Single source of truth for per-script token factors (Phase 179 estimators),
- * FTS routing (Phase 180), and observability event classes (Phases 180/181).
+ * Single source of truth for per-script token factors (the context estimators),
+ * FTS routing, and observability event classes.
  * Adding a script later is a data edit — append a row, never a new mechanism.
  *
- * Defined in @comis/core so @comis/agent (Phase 179 estimators),
- * @comis/memory and @comis/skills (Phase 180 FTS routing), and the executor
- * (Phase 181 reply-language resolver) can import it without creating a
+ * Defined in @comis/core so @comis/agent (token estimators),
+ * @comis/memory and @comis/skills (FTS routing), and the executor
+ * (reply-language resolver) can import it without creating a
  * package cycle. NO imports from any @comis package — this file is pure
- * static data + pure functions, no I/O/clock/env (I9), and contains no
- * regex (V5 — zero ReDoS surface; classification is a single O(n)
+ * static data + pure functions, no I/O/clock/env, and contains no
+ * regex (zero ReDoS surface; classification is a single O(n)
  * codepoint-range scan, allocation bounded by the table size, never by input).
  * @module
  */
@@ -20,18 +20,18 @@
 export type ScriptClass = "latin" | "cyrillic" | "hebrew" | "arabic" | "cjk" | "thai" | "greek" | "devanagari" | "other";
 /** One row of the SCRIPT_CLASSES table. Rows are scanned in declaration order
  *  (first-match-wins), so a combining-marks row placed BEFORE its letters row
- *  takes the lower factor for ambiguous codepoints (I3). */
+ *  takes the lower factor for ambiguous codepoints. */
 export interface ScriptClassRow {
     readonly class: ScriptClass;
     /** Inclusive codepoint ranges `[lo, hi]`. Empty for the `other` fallback row. */
     readonly ranges: ReadonlyArray<readonly [number, number]>;
-    /** Chars-per-token multiplier in (0, 1]; latin === 1.0 exactly (I1). */
+    /** Chars-per-token multiplier in (0, 1]; latin === 1.0 exactly. */
     readonly tokenFactor: number;
 }
 /**
  * Per-script classification table. Scanned in declaration order
  * (first-match-wins): the hebrew/arabic MARKS rows precede their letter rows
- * so combining marks take the lower factor (I3). Ranges use numeric
+ * so combining marks take the lower factor. Ranges use numeric
  * `[lo, hi]` pairs (never regex) with per-range named comments, mirroring the
  * auditable boundary documentation of `hasCjkCodepoints` (lcd-fts.ts).
  * Every factor carries a measurement provenance comment; the only unmeasured
@@ -50,8 +50,8 @@ export declare function classifyCodepoint(cp: number): ScriptClass | null;
  * UTF-16-unit-weighted shares over non-neutral chars; the values sum to 1
  * when any non-neutral char exists; empty Map otherwise.
  *
- * Codepoint iteration (`for..of`) is surrogate-safe (Pitfall 9); weights are
- * UTF-16 units via `ch.length` (Pitfall 11) so shares line up with the
+ * Codepoint iteration (`for..of`) is surrogate-safe; weights are
+ * UTF-16 units via `ch.length` so shares line up with the
  * `.length` denominators the estimators divide.
  */
 export declare function scriptShares(text: string): ReadonlyMap<ScriptClass, number>;