comisai 1.0.45 → 1.0.46

package/node_modules/@comis/daemon/dist/api/obs-handlers/fleet-cron-wake-gate.js

@@ -0,0 +1,128 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Cron wake-gate EFFICIENCY slice — the cross-session reducer for the `comis
+ * fleet` report, a sibling of `fleet-autonomy.ts`. Reduces the content-free
+ * `cron_wake_gate` DiagnosticRows (one per gated cron fire, written by
+ * `wakeGateEventToRow`) into a per-agent skip-rate + turns-saved + tool-call
+ * cost slice.
+ *
+ * ONE pure export over the already-read rows (NO clock, NO I/O, NO re-derivation
+ * over raw session rows):
+ *   - {@link computeCronWakeGateSlice} — the structured `cronWakeGate` block
+ *     (window totals + per-agent counts), or `undefined` when no gated fire is in
+ *     the window (honest omit — the `computeAutonomySlice` mold).
+ *
+ * The two legibility properties the slice carries:
+ *   - SUPPRESSION: a per-agent `skipRate == 1.0` is a gate that NEVER wakes the
+ *     model — visible whether it is working (savings) or silently poisoned.
+ *   - NET COST: `toolCalls` (the gate's cap-call cost) beside `turnsSaved` (the
+ *     avoided model turns) makes a gate that costs more than it saves legible.
+ *
+ * SECURITY INVARIANT (the digest-only report schema): counts + agent ids ONLY.
+ * Every `details` field is parsed via the defensive reader below, which reads
+ * ONLY the `wake` verdict + the `estTurnsSaved`/`toolCalls` counts — NEVER the
+ * gate's gathered payload, script source, or a secret. Safe to paste into a review.
+ *
+ * @module
+ */
+/**
+ * Defensive reader for the counts/verdict off a `cron_wake_gate` row's `details`
+ * — reads ONLY `wake`/`estTurnsSaved`/`toolCalls`/`failedOpen` (malformed/missing
+ * folds to a safe default, never throws, NEVER echoes a body). A row with an
+ * undefined `wake` still represents a fire; it is simply not counted as a skip.
+ * `failedOpen` defaults `false` (a row from a build before the field is a normal
+ * fire, never counted as a break).
+ */
+function readGateCounts(details) {
+    if (details === undefined)
+        return { wake: undefined, estTurnsSaved: 0, toolCalls: 0, failedOpen: false };
+    try {
+        const parsed = JSON.parse(details);
+        return {
+            wake: typeof parsed.wake === "boolean" ? parsed.wake : undefined,
+            estTurnsSaved: typeof parsed.estTurnsSaved === "number" ? parsed.estTurnsSaved : 0,
+            toolCalls: typeof parsed.toolCalls === "number" ? parsed.toolCalls : 0,
+            failedOpen: parsed.failedOpen === true,
+        };
+    }
+    catch {
+        return { wake: undefined, estTurnsSaved: 0, toolCalls: 0, failedOpen: false };
+    }
+}
+/**
+ * Reduce the windowed `cron_wake_gate` rows into the per-agent efficiency slice.
+ * Returns `undefined` (block OMITTED) when there is NO gated fire in the window —
+ * the honest-degradation case (no cron ran a wake-gate, or the store is unwired).
+ *
+ * - `fires.total` = the gated fire count; `fires.skipped` = fires with
+ *   `wake === false`; `fires.skipRate` = skipped / total (0 when total is 0).
+ * - `turnsSaved` = summed `estTurnsSaved` (the avoided model turns).
+ * - `toolCalls` = summed cap-call cost (the net-cost numerator).
+ * - `perAgent[]` = the same counts keyed by `agentId`, so a 100%-skip gate
+ *   (`skipRate == 1`) and an uneconomic gate (`toolCalls > turnsSaved`) are both
+ *   legible per agent. Ordered highest-fires-first, then agentId asc (deterministic).
+ *
+ * PURE — keys only on its argument; NO clock, NO I/O. Foreign-category rows are
+ * ignored so the reducer is safe over a mixed row set.
+ */
+export function computeCronWakeGateSlice(rows) {
+    const perAgent = new Map();
+    let total = 0;
+    let skipped = 0;
+    let failedOpen = 0;
+    let turnsSaved = 0;
+    let toolCalls = 0;
+    for (const row of rows) {
+        if (row.category !== "cron_wake_gate")
+            continue;
+        const counts = readGateCounts(row.details);
+        const isSkip = counts.wake === false;
+        const agentId = row.agentId ?? "unknown";
+        const bucket = perAgent.get(agentId) ?? { fires: 0, skipped: 0, failedOpen: 0, turnsSaved: 0, toolCalls: 0 };
+        bucket.fires += 1;
+        if (isSkip)
+            bucket.skipped += 1;
+        if (counts.failedOpen)
+            bucket.failedOpen += 1;
+        bucket.turnsSaved += counts.estTurnsSaved;
+        bucket.toolCalls += counts.toolCalls;
+        perAgent.set(agentId, bucket);
+        total += 1;
+        if (isSkip)
+            skipped += 1;
+        if (counts.failedOpen)
+            failedOpen += 1;
+        turnsSaved += counts.estTurnsSaved;
+        toolCalls += counts.toolCalls;
+    }
+    // Honest degradation: no gated fire in the window → omit the block.
+    if (total === 0)
+        return undefined;
+    return {
+        // `failedOpen`/`failOpenRate` distinguish a BROKEN gate (fails open every
+        // fire — saves nothing, costs its cap-calls) from a healthy monitor that
+        // legitimately always wakes; both otherwise read skipRate 0. It is the
+        // signal symmetric to a 100% skipRate (a poisoned suppress).
+        fires: {
+            total,
+            skipped,
+            skipRate: total > 0 ? skipped / total : 0,
+            failedOpen,
+            failOpenRate: total > 0 ? failedOpen / total : 0,
+        },
+        turnsSaved,
+        toolCalls,
+        perAgent: [...perAgent.entries()]
+            .map(([agentId, b]) => ({
+            agentId,
+            fires: b.fires,
+            skipped: b.skipped,
+            skipRate: b.fires > 0 ? b.skipped / b.fires : 0,
+            failedOpen: b.failedOpen,
+            failOpenRate: b.fires > 0 ? b.failedOpen / b.fires : 0,
+            turnsSaved: b.turnsSaved,
+            toolCalls: b.toolCalls,
+        }))
+            .sort((a, b) => b.fires - a.fires || a.agentId.localeCompare(b.agentId)),
+    };
+}

package/node_modules/@comis/daemon/dist/api/obs-handlers/fleet-findings-extractors.d.ts

@@ -4,10 +4,10 @@
  * findings.
  *
  * Extracted from `fleet-findings.ts` to keep that module under the obs-handlers
- * per-subdirectory file-size cap (the ORCH-OBS three-signal additions pushed it
- * over). No behavior change — every parser relocates byte-identically.
+ * per-subdirectory file-size cap (the orchestration three-signal additions pushed
+ * it over). No behavior change — every parser relocates byte-identically.
  *
- * SECURITY INVARIANT (H1 + the 159 digest-only schema): each parser reads a
+ * SECURITY INVARIANT (the digest-only report schema): each parser reads a
  * single untrusted `row.details` field DEFENSIVELY — malformed / missing folds
  * to a safe default, never throws, never echoes a raw `row.message`/`row.details`
  * body. Only closed enums + counts + short `key=` labels ever leave here.
@@ -28,20 +28,26 @@ export interface Finding {
     hint: string;
 }
 export declare function healthSignalLabel(row: DiagnosticRow): string;
-/** KNOB-03: servedBelowConfiguredCount from a config_posture row's details JSON.
+/** The closed `reason` sub-label from a health_signal row's details JSON (the
+ *  divergence class: fail_closed_rollover / live_store_divergence / …). Lets
+ *  the finding break a signal down by which failure class recurred without a
+ *  per-session explain. Malformed/missing → undefined (the finding then omits
+ *  the breakdown). The healthSignalLabel clone — counts + a closed label, no body. */
+export declare function healthSignalReason(row: DiagnosticRow): string | undefined;
+/** servedBelowConfiguredCount from a config_posture row's details JSON.
  *  Defensive parse — malformed/missing folds to 0 (soft-fail, counts only;
- *  the healthSignalLabel clone, T-176-13). */
+ *  the healthSignalLabel clone). */
 export declare function servedBelowConfiguredFromRow(row: DiagnosticRow): number;
-/** RESOLVE-01: chimericModelCount from a config_posture row's details JSON.
+/** chimericModelCount from a config_posture row's details JSON.
  *  Defensive parse — malformed/missing folds to 0 (the servedBelowConfigured clone). */
 export declare function chimericModelFromRow(row: DiagnosticRow): number;
-/** SPEND-05: pricingGapCount from a config_posture row's details JSON — configured
+/** pricingGapCount from a config_posture row's details JSON — configured
  *  agents burning tokens on remote-unknown-priced models (resolvePricingState ==
  *  "unknown"). Defensive parse — malformed/missing folds to 0 (the chimericModelFromRow
  *  clone; counts only, never a model id / config value body). */
 export declare function pricingGapFromRow(row: DiagnosticRow): number;
-/** T1.3 (F6): the SPECIFIC flagged config keys from a config_posture row — CLOSED labels
- *  only (never raw details / secret values, per the H1 no-body rule), so a fleet finding
+/** The SPECIFIC flagged config keys from a config_posture row — CLOSED labels
+ *  only (never raw details / secret values, per the no-body rule), so a fleet finding
  *  NAMES which knob is off instead of "the flagged config keys" (the live friction was
  *  grepping daemon.log to learn it was gateway.tls + CANARY_SECRET). served-below +
  *  chimeric have dedicated findings, so they are NOT repeated here. Malformed folds to []. */
@@ -49,21 +55,21 @@ export declare function flaggedPostureKeys(row: DiagnosticRow): string[];
 /** A single advisory multilingual flag from a model_health row. `undefined`
  *  means the key was absent or not a recognized value (omitted, no advisory). */
 export type MultilingualFlag = boolean | "unknown" | undefined;
-/** EMB-01: the two advisory multilingual flags from a model_health row's details
+/** The two advisory multilingual flags from a model_health row's details
  *  JSON. Defensive parse cloning servedBelowConfiguredFromRow — malformed/missing
  *  details folds to `{}` (soft-fail, never throws, NEVER echoes a body). A field
  *  is read only when it is a boolean or the exact string "unknown", else omitted
- *  (an old row that predates EMB-01 lacks the keys -> no advisory). */
+ *  (a row lacking the keys -> no advisory). */
 export declare function multilingualFromRow(row: DiagnosticRow): {
     embedding: MultilingualFlag;
     reranker: MultilingualFlag;
 };
-/** OBS-01 (Phase 180): health_signal labels that get a DEDICATED fleet finding
- *  (the KNOB-03 precedent) and are therefore EXCLUDED from the generic
+/** health_signal labels that get a DEDICATED fleet finding
+ *  (like served_below_configured) and are therefore EXCLUDED from the generic
  *  `health_signal:<label>` rollup below — listing one here without adding its
  *  dedicated branch would silently drop it, so the two move together. */
 export declare const DEDICATED_SCRIPT_SIGNALS: ReadonlySet<string>;
-/** OBS-04 (Phase 196): the closed domain `errorKind` (an `SttErrorKind`) carried
+/** The closed domain `errorKind` (an `SttErrorKind`) carried
  *  on a `voice_degraded` health_signal row's details JSON, parsed defensively
  *  (the `scriptZeroHitFromRow` clone). Returns `null` when the row is not a
  *  voice_degraded signal; returns `{ errorKind: undefined }` when it IS voice but
@@ -73,7 +79,7 @@ export declare const DEDICATED_SCRIPT_SIGNALS: ReadonlySet<string>;
 export declare function voiceDegradedFromRow(row: DiagnosticRow): {
     errorKind: string | undefined;
 } | null;
-/** OBS-01: `{scriptClass, lane}` from a script_zero_hit row's details JSON.
+/** `{scriptClass, lane}` from a script_zero_hit row's details JSON.
  *  Defensive parse cloning healthSignalLabel's style — malformed/missing folds
  *  to null (the row is then ignored by the dedicated grouping; counts only, no
  *  body ever surfaces). Returns the closed enums verbatim (untrusted-row safe:
@@ -82,7 +88,7 @@ export declare function scriptZeroHitFromRow(row: DiagnosticRow): {
     scriptClass: string;
     lane: string;
 } | null;
-/** TELEM-01 (Plan 173-03): `{tier, schemaValid}` from a pipeline_authoring row's
+/** `{tier, schemaValid}` from a pipeline_authoring row's
  *  details JSON. Defensive parse cloning `scriptZeroHitFromRow` — a non-pipeline /
  *  malformed / missing row folds to `null` (the row is then ignored by both the
  *  reducer and the dedicated finding; counts only, no body ever surfaces, never
@@ -92,7 +98,19 @@ export declare function pipelineAuthoringFromRow(row: DiagnosticRow): {
     tier: string;
     schemaValid: boolean;
 } | null;
-/** ORCH-OBS: the closed violated-dimension labels from a `sandbox_downgrade_refused`
+/** The `estSavedTokens` estimate + the closed `failureClass` from an
+ *  `orchestrate_efficiency` health_signal row's details JSON (the run-summary
+ *  shape). Defensive parse cloning `pipelineAuthoringFromRow` — a non-orchestrate /
+ *  malformed / missing row folds to `null` (ignored; counts only, never throws). A
+ *  run that materialized nothing still counts (estSavedTokens coerces to 0 — the
+ *  run is real, it just saved nothing), so ONLY a wrong-signal/malformed row returns
+ *  null. `failureClass` is a CLOSED enum (or undefined on a clean run), rendered only
+ *  into a degraded-run count — never the runId, the stdout, or a body. */
+export declare function orchestrateEfficiencyFromRow(row: DiagnosticRow): {
+    estSavedTokens: number;
+    failureClass: string | undefined;
+} | null;
+/** The closed violated-dimension labels from a `sandbox_downgrade_refused`
  *  row's details JSON. Defensive parse cloning `pipelineAuthoringFromRow` — a
  *  non-sandbox / malformed / missing row folds to `null` (ignored; counts only, no
  *  body, never throws). Returns ONLY the closed dimension enum strings — never a
@@ -100,22 +118,22 @@ export declare function pipelineAuthoringFromRow(row: DiagnosticRow): {
 export declare function sandboxDowngradeFromRow(row: DiagnosticRow): {
     dimensions: string[];
 } | null;
-/** ORCH-OBS: `{transient}` from a `delivery_deadlettered` row's details JSON.
+/** `{transient}` from a `delivery_deadlettered` row's details JSON.
  *  Defensive parse — non-deadletter / malformed / missing folds to `null` (ignored).
  *  `transient` true = retries exhausted, false = immediate permanent. Never reads the
  *  runId or any body (the row never carried them). */
 export declare function deliveryDeadletteredFromRow(row: DiagnosticRow): {
     transient: boolean;
 } | null;
-/** ORCH-OBS: the closed `capSource` from a `node_budget_exceeded` row's details JSON.
+/** The closed `capSource` from a `node_budget_exceeded` row's details JSON.
  *  Defensive parse — non-budget / malformed / missing / unrecognized capSource folds
  *  to `null` (ignored). Returns the closed precedence enum verbatim (untrusted-row
  *  safe: only ever rendered into a count + a `capSource=` label). */
 export declare function nodeBudgetExceededFromRow(row: DiagnosticRow): {
     capSource: string;
 } | null;
-/** FLEET-01 (Phase 220-03): the closed orphan `reason` enum + the `rootRunId` from a
- *  `durable_orphaned` health_signal row's details JSON (the Plan-01 obs-autonomy-rows
+/** The closed orphan `reason` enum + the `rootRunId` from a
+ *  `durable_orphaned` health_signal row's details JSON (the obs-autonomy-rows
  *  shape). Defensive parse cloning `nodeBudgetExceededFromRow` — a non-orphaned /
  *  malformed / missing row folds to `null` (ignored; counts only, never throws). The
  *  `reason` is a CLOSED enum (not_resumable / reread_failed / invalid_caps /
@@ -126,7 +144,7 @@ export declare function durableOrphanedFromRow(row: DiagnosticRow): {
     reason: string;
     rootRunId?: string;
 } | null;
-/** FLEET-01 (Phase 220-03): the resumed `stepIndex` + the `rootRunId` from a
+/** The resumed `stepIndex` + the `rootRunId` from a
  *  `durable_resumed` health_signal row's details JSON. Defensive parse (the
  *  durableOrphanedFromRow clone) — a non-resumed / malformed / missing row folds to
  *  `null`. A resumed run is healthy crash-recovery (it has NO finding); this extractor
@@ -134,28 +152,28 @@ export declare function durableOrphanedFromRow(row: DiagnosticRow): {
 export declare function durableResumedFromRow(row: DiagnosticRow): {
     rootRunId?: string;
 } | null;
-/** FLEET-01 (Phase 220-03): the revoked COUNT + the `rootRunId` from an
+/** The revoked COUNT + the `rootRunId` from an
  *  `autonomy_revoked` health_signal row's details JSON. Defensive parse (the
  *  durableOrphanedFromRow clone) — a non-revoked / malformed / missing row folds to
  *  `null`. The `revoked` count defaults to 0 when absent/non-finite. NEVER reads a
- *  lease bearer / selector / body (the Plan-01 row never carried them — T-220-02). */
+ *  lease bearer / selector / body (the row never carried them). */
 export declare function autonomyRevokedFromRow(row: DiagnosticRow): {
     revoked: number;
     rootRunId?: string;
 } | null;
-/** FLEET-01 (Phase 220-03): the killed COUNT + the `rootRunId` from an
+/** The killed COUNT + the `rootRunId` from an
  *  `autonomy_killed` health_signal row's details JSON. Defensive parse (the
  *  autonomyRevokedFromRow clone). A hard kill (run.kill) flips durable status to
  *  'revoked' INDISTINGUISHABLY from a cooperative revoke in the table — so this
  *  DISTINCT signal label is the ONLY way the fleet lens separates killed from revoked
- *  counts (the Plan-01 kill≠revoke separation). Counts/ids only, never a body. */
+ *  counts (the kill≠revoke separation). Counts/ids only, never a body. */
 export declare function autonomyKilledFromRow(row: DiagnosticRow): {
     killed: number;
     rootRunId?: string;
 } | null;
-/** FLEET-02 (Phase 220-05): the per-event denial-breaker COUNT + the `rootRunId` from
+/** The per-event denial-breaker COUNT + the `rootRunId` from
  *  an `autonomy_denial_breaker` health_signal row's details JSON. Defensive parse (the
- *  autonomyKilledFromRow clone). A Phase-217 capability-DENIAL breaker trip is NEVER a
+ *  autonomyKilledFromRow clone). A capability-DENIAL breaker trip is NEVER a
  *  session endReason / breakerTripCount — so this DISTINCT signal label is the ONLY way
  *  the fleet lens counts it SEPARABLY from the tool-failure breaker (breakerTripTotal),
  *  the same separation discipline as kill≠revoke. The `denialBreakerTrips` count

package/node_modules/@comis/daemon/dist/api/obs-handlers/fleet-findings-extractors.js

@@ -9,9 +9,25 @@ export function healthSignalLabel(row) {
         return "unknown"; // malformed details JSON — counts only, no body.
     }
 }
-/** KNOB-03: servedBelowConfiguredCount from a config_posture row's details JSON.
+/** The closed `reason` sub-label from a health_signal row's details JSON (the
+ *  divergence class: fail_closed_rollover / live_store_divergence / …). Lets
+ *  the finding break a signal down by which failure class recurred without a
+ *  per-session explain. Malformed/missing → undefined (the finding then omits
+ *  the breakdown). The healthSignalLabel clone — counts + a closed label, no body. */
+export function healthSignalReason(row) {
+    if (row.details === undefined)
+        return undefined;
+    try {
+        const parsed = JSON.parse(row.details);
+        return typeof parsed.reason === "string" && parsed.reason.length > 0 ? parsed.reason : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** servedBelowConfiguredCount from a config_posture row's details JSON.
  *  Defensive parse — malformed/missing folds to 0 (soft-fail, counts only;
- *  the healthSignalLabel clone, T-176-13). */
+ *  the healthSignalLabel clone). */
 export function servedBelowConfiguredFromRow(row) {
     if (row.details === undefined)
         return 0;
@@ -24,7 +40,7 @@ export function servedBelowConfiguredFromRow(row) {
         return 0;
     }
 }
-/** RESOLVE-01: chimericModelCount from a config_posture row's details JSON.
+/** chimericModelCount from a config_posture row's details JSON.
  *  Defensive parse — malformed/missing folds to 0 (the servedBelowConfigured clone). */
 export function chimericModelFromRow(row) {
     if (row.details === undefined)
@@ -38,7 +54,7 @@ export function chimericModelFromRow(row) {
         return 0;
     }
 }
-/** SPEND-05: pricingGapCount from a config_posture row's details JSON — configured
+/** pricingGapCount from a config_posture row's details JSON — configured
  *  agents burning tokens on remote-unknown-priced models (resolvePricingState ==
  *  "unknown"). Defensive parse — malformed/missing folds to 0 (the chimericModelFromRow
  *  clone; counts only, never a model id / config value body). */
@@ -54,8 +70,8 @@ export function pricingGapFromRow(row) {
         return 0;
     }
 }
-/** T1.3 (F6): the SPECIFIC flagged config keys from a config_posture row — CLOSED labels
- *  only (never raw details / secret values, per the H1 no-body rule), so a fleet finding
+/** The SPECIFIC flagged config keys from a config_posture row — CLOSED labels
+ *  only (never raw details / secret values, per the no-body rule), so a fleet finding
  *  NAMES which knob is off instead of "the flagged config keys" (the live friction was
  *  grepping daemon.log to learn it was gateway.tls + CANARY_SECRET). served-below +
  *  chimeric have dedicated findings, so they are NOT repeated here. Malformed folds to []. */
@@ -72,7 +88,7 @@ export function flaggedPostureKeys(row) {
         if (Array.isArray(d.strandedFindings) && d.strandedFindings.length > 0) {
             keys.push(`stranded secrets (${d.strandedFindings.length})`);
         }
-        // RELAX-SURFACE: the no-downgrade sandbox invariant is relaxed (a child may run
+        // The no-downgrade sandbox invariant is relaxed (a child may run
         // a weaker posture than its parent) — NAME the exact knob, not "a flagged key".
         if (d.sandboxNoDowngradeDisabled === true) {
             keys.push("security.agentToAgent.sandboxNoDowngrade (off)");
@@ -83,11 +99,11 @@ export function flaggedPostureKeys(row) {
         return [];
     }
 }
-/** EMB-01: the two advisory multilingual flags from a model_health row's details
+/** The two advisory multilingual flags from a model_health row's details
  *  JSON. Defensive parse cloning servedBelowConfiguredFromRow — malformed/missing
  *  details folds to `{}` (soft-fail, never throws, NEVER echoes a body). A field
  *  is read only when it is a boolean or the exact string "unknown", else omitted
- *  (an old row that predates EMB-01 lacks the keys -> no advisory). */
+ *  (a row lacking the keys -> no advisory). */
 export function multilingualFromRow(row) {
     if (row.details === undefined)
         return { embedding: undefined, reranker: undefined };
@@ -103,24 +119,29 @@ export function multilingualFromRow(row) {
         return { embedding: undefined, reranker: undefined };
     }
 }
-/** OBS-01 (Phase 180): health_signal labels that get a DEDICATED fleet finding
- *  (the KNOB-03 precedent) and are therefore EXCLUDED from the generic
+/** health_signal labels that get a DEDICATED fleet finding
+ *  (like served_below_configured) and are therefore EXCLUDED from the generic
  *  `health_signal:<label>` rollup below — listing one here without adding its
  *  dedicated branch would silently drop it, so the two move together. */
 export const DEDICATED_SCRIPT_SIGNALS = new Set([
     "script_zero_hit",
     "summary_language_mismatch",
     "generation_quality",
-    // OBS-04 (Phase 196): voice_degraded gets the dedicated `voice_health` finding
+    // voice_degraded gets the dedicated `voice_health` finding
     // below — excluded here so it is not ALSO counted in the generic
-    // `health_signal:voice_degraded` rollup (the double-report KNOB-03 guards against).
+    // `health_signal:voice_degraded` rollup (the double-report this set guards against).
     "voice_degraded",
-    // TELEM-01 (Plan 173-03): pipeline_authoring gets the dedicated finding below
+    // pipeline_authoring gets the dedicated finding below
     // (the small-tier invalid rate). Excluded here so it is NOT also rolled into the
     // generic `health_signal:pipeline_authoring` count — the finding + this entry
     // MOVE TOGETHER (listing it here without the dedicated branch silently drops it).
     "pipeline_authoring",
-    // ORCH-OBS (orchestration-observability): the three previously-dark daemon-side
+    // orchestrate_efficiency gets the dedicated finding below (the measured
+    // token-savings roll-up). Excluded here so it is NOT also counted in the generic
+    // `health_signal:orchestrate_efficiency` rollup — the finding + this entry MOVE
+    // TOGETHER (listing it here without the dedicated branch silently drops it).
+    "orchestrate_efficiency",
+    // The three previously-dark daemon-side
     // orchestration signals each get a dedicated finding below (named violated
     // dimensions / transient-vs-permanent split / dominant cap source). Excluded from
     // the generic rollup so they are not double-counted — each finding + its entry here
@@ -128,8 +149,8 @@ export const DEDICATED_SCRIPT_SIGNALS = new Set([
     "sandbox_downgrade_refused",
     "delivery_deadlettered",
     "node_budget_exceeded",
-    // FLEET-01 (Phase 220-03): the four autonomy/durable-run signals Plan 01
-    // persists are EXCLUDED from the generic `health_signal:<label>` rollup.
+    // The four persisted autonomy/durable-run signals
+    // are EXCLUDED from the generic `health_signal:<label>` rollup.
     // durable_orphaned / autonomy_revoked / autonomy_killed each get a dedicated
     // finding below (orphaned reason group / revoked count / killed count) — finding
     // + entry MOVE TOGETHER. durable_resumed is healthy crash-recovery, NOT
@@ -142,13 +163,13 @@ export const DEDICATED_SCRIPT_SIGNALS = new Set([
     "durable_resumed",
     "autonomy_revoked",
     "autonomy_killed",
-    // FLEET-02 (Phase 220-05): the capability-denial breaker trip gets a dedicated
+    // The capability-denial breaker trip gets a dedicated
     // finding below (the denialBreakerN abort) — EXCLUDED from the generic rollup so
     // it is not double-counted as `health_signal:autonomy_denial_breaker` (finding +
     // entry MOVE TOGETHER; listing it here without the dedicated branch silently drops it).
     "autonomy_denial_breaker",
 ]);
-/** OBS-04 (Phase 196): the closed domain `errorKind` (an `SttErrorKind`) carried
+/** The closed domain `errorKind` (an `SttErrorKind`) carried
  *  on a `voice_degraded` health_signal row's details JSON, parsed defensively
  *  (the `scriptZeroHitFromRow` clone). Returns `null` when the row is not a
  *  voice_degraded signal; returns `{ errorKind: undefined }` when it IS voice but
@@ -169,7 +190,7 @@ export function voiceDegradedFromRow(row) {
         return null; // malformed details JSON — counts only, no body.
     }
 }
-/** OBS-01: `{scriptClass, lane}` from a script_zero_hit row's details JSON.
+/** `{scriptClass, lane}` from a script_zero_hit row's details JSON.
  *  Defensive parse cloning healthSignalLabel's style — malformed/missing folds
  *  to null (the row is then ignored by the dedicated grouping; counts only, no
  *  body ever surfaces). Returns the closed enums verbatim (untrusted-row safe:
@@ -189,7 +210,7 @@ export function scriptZeroHitFromRow(row) {
         return null;
     }
 }
-/** TELEM-01 (Plan 173-03): `{tier, schemaValid}` from a pipeline_authoring row's
+/** `{tier, schemaValid}` from a pipeline_authoring row's
  *  details JSON. Defensive parse cloning `scriptZeroHitFromRow` — a non-pipeline /
  *  malformed / missing row folds to `null` (the row is then ignored by both the
  *  reducer and the dedicated finding; counts only, no body ever surfaces, never
@@ -210,7 +231,32 @@ export function pipelineAuthoringFromRow(row) {
         return null; // malformed details JSON — counts only, no body.
     }
 }
-/** ORCH-OBS: the closed violated-dimension labels from a `sandbox_downgrade_refused`
+/** The `estSavedTokens` estimate + the closed `failureClass` from an
+ *  `orchestrate_efficiency` health_signal row's details JSON (the run-summary
+ *  shape). Defensive parse cloning `pipelineAuthoringFromRow` — a non-orchestrate /
+ *  malformed / missing row folds to `null` (ignored; counts only, never throws). A
+ *  run that materialized nothing still counts (estSavedTokens coerces to 0 — the
+ *  run is real, it just saved nothing), so ONLY a wrong-signal/malformed row returns
+ *  null. `failureClass` is a CLOSED enum (or undefined on a clean run), rendered only
+ *  into a degraded-run count — never the runId, the stdout, or a body. */
+export function orchestrateEfficiencyFromRow(row) {
+    if (row.details === undefined)
+        return null;
+    try {
+        const parsed = JSON.parse(row.details);
+        if (parsed.signal !== "orchestrate_efficiency")
+            return null;
+        const estSavedTokens = typeof parsed.estSavedTokens === "number" && Number.isFinite(parsed.estSavedTokens) && parsed.estSavedTokens > 0
+            ? parsed.estSavedTokens
+            : 0;
+        const failureClass = typeof parsed.failureClass === "string" && parsed.failureClass.length > 0 ? parsed.failureClass : undefined;
+        return { estSavedTokens, failureClass };
+    }
+    catch {
+        return null; // malformed details JSON — counts only, no body.
+    }
+}
+/** The closed violated-dimension labels from a `sandbox_downgrade_refused`
  *  row's details JSON. Defensive parse cloning `pipelineAuthoringFromRow` — a
  *  non-sandbox / malformed / missing row folds to `null` (ignored; counts only, no
  *  body, never throws). Returns ONLY the closed dimension enum strings — never a
@@ -231,7 +277,7 @@ export function sandboxDowngradeFromRow(row) {
         return null;
     }
 }
-/** ORCH-OBS: `{transient}` from a `delivery_deadlettered` row's details JSON.
+/** `{transient}` from a `delivery_deadlettered` row's details JSON.
  *  Defensive parse — non-deadletter / malformed / missing folds to `null` (ignored).
  *  `transient` true = retries exhausted, false = immediate permanent. Never reads the
  *  runId or any body (the row never carried them). */
@@ -248,7 +294,7 @@ export function deliveryDeadletteredFromRow(row) {
         return null;
     }
 }
-/** ORCH-OBS: the closed `capSource` from a `node_budget_exceeded` row's details JSON.
+/** The closed `capSource` from a `node_budget_exceeded` row's details JSON.
  *  Defensive parse — non-budget / malformed / missing / unrecognized capSource folds
  *  to `null` (ignored). Returns the closed precedence enum verbatim (untrusted-row
  *  safe: only ever rendered into a count + a `capSource=` label). */
@@ -266,8 +312,8 @@ export function nodeBudgetExceededFromRow(row) {
         return null;
     }
 }
-/** FLEET-01 (Phase 220-03): the closed orphan `reason` enum + the `rootRunId` from a
- *  `durable_orphaned` health_signal row's details JSON (the Plan-01 obs-autonomy-rows
+/** The closed orphan `reason` enum + the `rootRunId` from a
+ *  `durable_orphaned` health_signal row's details JSON (the obs-autonomy-rows
  *  shape). Defensive parse cloning `nodeBudgetExceededFromRow` — a non-orphaned /
  *  malformed / missing row folds to `null` (ignored; counts only, never throws). The
  *  `reason` is a CLOSED enum (not_resumable / reread_failed / invalid_caps /
@@ -289,7 +335,7 @@ export function durableOrphanedFromRow(row) {
         return null;
     }
 }
-/** FLEET-01 (Phase 220-03): the resumed `stepIndex` + the `rootRunId` from a
+/** The resumed `stepIndex` + the `rootRunId` from a
  *  `durable_resumed` health_signal row's details JSON. Defensive parse (the
  *  durableOrphanedFromRow clone) — a non-resumed / malformed / missing row folds to
  *  `null`. A resumed run is healthy crash-recovery (it has NO finding); this extractor
@@ -308,11 +354,11 @@ export function durableResumedFromRow(row) {
         return null;
     }
 }
-/** FLEET-01 (Phase 220-03): the revoked COUNT + the `rootRunId` from an
+/** The revoked COUNT + the `rootRunId` from an
  *  `autonomy_revoked` health_signal row's details JSON. Defensive parse (the
  *  durableOrphanedFromRow clone) — a non-revoked / malformed / missing row folds to
  *  `null`. The `revoked` count defaults to 0 when absent/non-finite. NEVER reads a
- *  lease bearer / selector / body (the Plan-01 row never carried them — T-220-02). */
+ *  lease bearer / selector / body (the row never carried them). */
 export function autonomyRevokedFromRow(row) {
     if (row.details === undefined)
         return null;
@@ -328,12 +374,12 @@ export function autonomyRevokedFromRow(row) {
         return null;
     }
 }
-/** FLEET-01 (Phase 220-03): the killed COUNT + the `rootRunId` from an
+/** The killed COUNT + the `rootRunId` from an
  *  `autonomy_killed` health_signal row's details JSON. Defensive parse (the
  *  autonomyRevokedFromRow clone). A hard kill (run.kill) flips durable status to
  *  'revoked' INDISTINGUISHABLY from a cooperative revoke in the table — so this
  *  DISTINCT signal label is the ONLY way the fleet lens separates killed from revoked
- *  counts (the Plan-01 kill≠revoke separation). Counts/ids only, never a body. */
+ *  counts (the kill≠revoke separation). Counts/ids only, never a body. */
 export function autonomyKilledFromRow(row) {
     if (row.details === undefined)
         return null;
@@ -349,9 +395,9 @@ export function autonomyKilledFromRow(row) {
         return null;
     }
 }
-/** FLEET-02 (Phase 220-05): the per-event denial-breaker COUNT + the `rootRunId` from
+/** The per-event denial-breaker COUNT + the `rootRunId` from
  *  an `autonomy_denial_breaker` health_signal row's details JSON. Defensive parse (the
- *  autonomyKilledFromRow clone). A Phase-217 capability-DENIAL breaker trip is NEVER a
+ *  autonomyKilledFromRow clone). A capability-DENIAL breaker trip is NEVER a
  *  session endReason / breakerTripCount — so this DISTINCT signal label is the ONLY way
  *  the fleet lens counts it SEPARABLY from the tool-failure breaker (breakerTripTotal),
  *  the same separation discipline as kill≠revoke. The `denialBreakerTrips` count

package/node_modules/@comis/daemon/dist/api/obs-handlers/fleet-findings.d.ts

@@ -1,14 +1,13 @@
 /**
- * Fleet findings derivation: turn the I-track diagnostic rows (`health_signal` /
+ * Fleet findings derivation: turn the ingested diagnostic rows (`health_signal` /
  * `model_health` / `config_posture`) into `{code, detail, count, hint}` findings.
  *
- * Extracted from `fleet-health.ts` to keep that module under the obs-handlers
- * per-subdirectory file-size cap (the OBS-01 Phase-180 script findings pushed it
- * over). No behavior change — `buildFindings` + the `Finding` shape + the
- * defensive details parsers relocate byte-identically; the assembler imports
- * them back.
+ * Lives separately from `fleet-health.ts` to keep that module under the
+ * obs-handlers per-subdirectory file-size cap; the assembler there imports
+ * `buildFindings`, the `Finding` shape, and the defensive details parsers
+ * from here.
  *
- * SECURITY INVARIANT (H1 + the 159 digest-only schema): findings carry counts +
+ * SECURITY INVARIANT (the digest-only report schema): findings carry counts +
  * short codes + hints ONLY — NEVER concatenate the raw `row.message`/`row.details`
  * body. Every `details` JSON field read here is parsed defensively (malformed /
  * missing folds to a safe default, never throws, never echoes a body). The
@@ -22,25 +21,23 @@ import type { PipelineAuthoringAggregate } from "@comis/observability";
 import { type Finding } from "./fleet-findings-extractors.js";
 export type { Finding };
 /**
- * TELEM-01 (Plan 173-03): the pipeline-authoring aggregate the Phase-174 gate
+ * The pipeline-authoring aggregate the authoring gate
  * (`pipelineAuthoringGate`) consumes — computed compute-on-read over the windowed
- * `health_signal` rows (no persisted rollup; Open Q2 / D-AGGREGATE).
+ * `health_signal` rows (no persisted rollup).
  *
- * The `PipelineAuthoringAggregate` type is now SINGLE-SOURCED in
- * `@comis/observability` (Plan 173-04, MEDIUM-4) — the provisional local
- * interface declared here at Plan 03 was deleted and this file imports the
- * canonical type (see the top-of-file `import type`). The field NAMES + ORDER
- * (`smallTierInvocations`, `smallTierValidRate`, `frontierValidRate`) are
- * unchanged — the swap is structural.
+ * The `PipelineAuthoringAggregate` type is SINGLE-SOURCED in
+ * `@comis/observability` — this file imports the
+ * canonical type (see the top-of-file `import type`) rather than declaring a
+ * local duplicate.
  *
- * The small/local tier = capabilityClass "small" OR "nano" (D-TIER); frontier =
+ * The small/local tier = capabilityClass "small" OR "nano"; frontier =
  * "frontier". "mid" and "unknown" rows are in NEITHER cohort (they are not the
  * comparison tiers). Rates are 0 (never NaN) when the cohort is empty.
  *
  * Reduce the windowed `health_signal` rows to the `PipelineAuthoringAggregate`.
  * PURE — no I/O, no globals, no Date.now(); malformed / non-pipeline rows fold out
- * (counted in neither cohort, never throws). Exported so Plan 04 / fleet-health.ts
+ * (counted in neither cohort, never throws). Exported so fleet-health.ts
  * can feed the gate.
  */
 export declare function pipelineAuthoringAggregateFromRows(rows: readonly DiagnosticRow[]): PipelineAuthoringAggregate;
-export declare function buildFindings(healthSignals: readonly DiagnosticRow[], modelHealth: readonly DiagnosticRow[], configPosture: readonly DiagnosticRow[], learningHealth?: readonly DiagnosticRow[], memoryLifecycle?: readonly DiagnosticRow[]): Finding[];
+export declare function buildFindings(healthSignals: readonly DiagnosticRow[], modelHealth: readonly DiagnosticRow[], configPosture: readonly DiagnosticRow[], learningHealth?: readonly DiagnosticRow[], memoryLifecycle?: readonly DiagnosticRow[], cronWakeGate?: readonly DiagnosticRow[]): Finding[];