comisai 1.0.45 → 1.0.46

package/node_modules/@comis/daemon/dist/autonomy/durable-resume-engine.js

@@ -1,33 +1,33 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * Durable resume engine (Phase 216 — the brain of the phase). On boot (and on
+ * Durable resume engine. On boot (and on
  * each watchdog tick) it turns persisted state back into live runs:
  *
- *   1. RECONCILE crashed-mid-send rows (ONCE-03/ONCE-04). An `unknown_after_send`
+ *   1. RECONCILE crashed-mid-send rows. An `unknown_after_send`
  *      ledger row is NEVER blind-replayed — the owning channel's `reconcileSend?`
  *      resolves it three ways: `sent` → ack once (commit, no replay), `not_sent`
  *      → replay exactly once, `unresolved` (or a channel that cannot reconcile)
  *      → park + escalate. A channel with no `reconcileSend` is treated as
- *      `unresolved` (Pitfall 2 — never a double-send dressed as a reconcile).
- *   2. RESUME-OR-ORPHAN (DUR-02/DUR-03). For each resumable run the engine
+ *      `unresolved` (never a double-send dressed as a reconcile).
+ *   2. RESUME-OR-ORPHAN. For each resumable run the engine
  *      re-mints a lease from the PERSISTED attenuated caps VERBATIM (never
  *      re-attenuating from a live parent — the persisted caps ARE the attenuated
  *      result). A `revoked` re-read, a caps-parse failure (a tampered superset),
  *      or an un-resumable run is ORPHANED + the operator is notified — never
  *      silently re-minted and never silently dropped. A legitimate never-sent run
- *      (stepIndex = -1, the NEW-5 sentinel) PASSES the guard and is resumed.
- *   3. BOUNDED RECOVERY (HB-02). The whole pass is bounded by a wall-clock
+ *      (stepIndex = -1, the never-sent sentinel) PASSES the guard and is resumed.
+ *   3. BOUNDED RECOVERY. The whole pass is bounded by a wall-clock
  *      `recoveryBudgetMs`; a backlog larger than the budget is partially
  *      recovered and the remainder DEFERRED (status stays `running`, so the
  *      watchdog / next boot picks them up) — no thundering herd.
- *   4. ORPHAN NOTIFICATION (HB-03). Every orphan fires the injected NotifyFn + an
+ *   4. ORPHAN NOTIFICATION. Every orphan fires the injected NotifyFn + an
  *      eventBus `durable:orphaned` + an INFO line — an un-resumed run is never
- *      silently vanished (DUR-02).
+ *      silently vanished.
  *
  * The engine is deliberately PURE / I/O-free: every dependency (the stores, the
  * LeaseManager re-mint, the channel lookup, the replay closure, the operator
  * notify, the clock, the event bus) is INJECTED so it is exhaustively
- * unit-testable with a fake clock + stub stores + a stub channel. Plan 07's
+ * unit-testable with a fake clock + stub stores + a stub channel. The
  * wiring binds it to the real stores / LeaseManager / channel adapters and calls
  * `resumeAll()` on boot. No callable-global time/timer reads here (the
  * globals.test.ts arch-gate forbids the wall-clock and interval-scheduler
@@ -37,7 +37,7 @@
  * line (with durationMs) + an eventBus event; every failure branch carries
  * `hint` + `errorKind` (the closed precondition|dependency|platform|internal
  * union). Content-free: rootRunId/stepIndex/state/reconcileOutcome/counts ONLY —
- * never the message body (the reconcile query keys on a contentDigest, T-216-17).
+ * never the message body (the reconcile query keys on a contentDigest).
  *
  * @module
  */
@@ -47,19 +47,18 @@ import { isPermanentError, attenuateCaps, parseDurableRunRecord, } from "@comis/
 // trust boundary at SPAWN time (capability.ts:92). On RESUME the engine does NOT
 // call it: `record.caps` is already the persisted attenuated result, and
 // re-attenuating from a (possibly stale or broadened) live parent would be the
-// DUR-03 elevation-of-privilege hole. The `void` keeps the import live without
+// elevation-of-privilege hole. The `void` keeps the import live without
 // invoking it.
 void attenuateCaps;
 /**
- * FLEET-03 (Phase 220-01): map the engine's free-text orphan reason to the
- * CLOSED enum the `durable:orphaned` EVENT carries (events-orchestration.ts).
- * TOTAL over `string` — the `default` arm guarantees every input (including a
- * brand-new unmapped reason) returns a union member and the function NEVER
- * echoes its `freeText` argument. This is the T-220-01 content-free invariant AT
- * THE SOURCE: the free string stays ONLY on the WARN log / notify (the operator's
- * debugging surface); the closed enum is the only thing that crosses onto the
- * event/obs-row. Mirrors the closed-union discriminator pattern of
- * `execution:aborted.reason`.
+ * Map the engine's free-text orphan reason to the CLOSED enum the
+ * `durable:orphaned` EVENT carries (events-orchestration.ts). TOTAL over
+ * `string` — the `default` arm guarantees every input (including a brand-new
+ * unmapped reason) returns a union member and the function NEVER echoes its
+ * `freeText` argument. This is the content-free invariant AT THE SOURCE: the
+ * free string stays ONLY on the WARN log / notify (the operator's debugging
+ * surface); the closed enum is the only thing that crosses onto the event/obs-row.
+ * Mirrors the closed-union discriminator pattern of `execution:aborted.reason`.
  */
 export function orphanReasonToEnum(freeText) {
     // Match against the engine's known orphan() call-site reasons (durable-resume-engine
@@ -74,6 +73,33 @@ export function orphanReasonToEnum(freeText) {
     // input collapse to resume_failed, so a free-text reason can never leak through.
     return "resume_failed";
 }
+/**
+ * Reclaim a dead resumable orchestrate run's artifacts: its surviving `results/`
+ * (the checkpoint blob + any materialized results) + the pinned `<scriptRef>`.
+ *
+ * The RESUME-04 orphan sweep. A run orphaned on boot (its checkpoint gone) or on a
+ * lapsed-heartbeat watchdog tick has NO surviving runner to GC its workspace (the
+ * runner's own run-end cleanup never fired — the process crashed mid-pipeline), so
+ * the orphan path is the OWNER of the reclaim. SCOPED to orchestrate-kind rows
+ * (`scriptRef != null` — a re-runnable orchestrate row); a DAG/flat legacy orphan
+ * carries no `scriptRef` and is a no-op. IDEMPOTENT — a second reclaim finds the
+ * files already gone (the seams degrade, never throw). Composes the EXISTING
+ * `cleanupRun` + a guarded `rmSync` — no new GC primitive (NG4).
+ */
+export async function reclaimOrphanedOrchestrateRun(record, seams) {
+    const scriptRef = record.scriptRef;
+    // Scoped: only a re-runnable orchestrate row (a pinned scriptRef) has artifacts
+    // this hook owns; a DAG/flat legacy orphan is unaffected.
+    if (scriptRef == null)
+        return;
+    const workspacePath = seams.workspaceFor(record);
+    if (workspacePath === undefined)
+        return; // unresolvable workspace ⇒ nothing to reclaim
+    // 1. results/ — the checkpoint blob (+ any surviving materialized results) live here.
+    await seams.cleanupResults(workspacePath, record.rootRunId);
+    // 2. the pinned script at the workspace ROOT (cleanupRun is results/-only).
+    seams.removePinnedScript(workspacePath, scriptRef);
+}
 /**
  * The reconcile-window half-width (ms) the query brackets around the row. A
  * crashed send's true platform timestamp is near the row's recovery time; a
@@ -83,16 +109,16 @@ export function orphanReasonToEnum(freeText) {
  */
 const RECONCILE_WINDOW_MS = 600_000; // 10 min
 /**
- * Reconcile ONE crashed-mid-send ledger row (ONCE-03/ONCE-04). The exactly-once
+ * Reconcile ONE crashed-mid-send ledger row. The exactly-once
  * core: it asks the channel "was this sent?" and resolves the row accordingly —
  * it NEVER blind-replays.
  *
- *   - `committed` row → no-op (ONCE-02; already terminal-success).
+ *   - `committed` row → no-op (already terminal-success).
  *   - channel has no `reconcileSend` → treated as `unresolved` → park + escalate,
- *     NO replay (Pitfall 2 — an un-queryable channel must never double-send).
+ *     NO replay (an un-queryable channel must never double-send).
  *   - `sent`       → resolveReconcile("sent") + commit(platformMessageId); NO replay.
  *   - `not_sent`   → resolveReconcile("not_sent") + replay ONCE; on ok → commit;
- *                    on a PERMANENT error → markFailed("permanent") (ONCE-04, retry
+ *                    on a PERMANENT error → markFailed("permanent") (retry
  *                    budget skipped); on a TRANSIENT error → leave for the next tick.
  *   - `unresolved` → resolveReconcile("unresolved") + notify escalation; NO replay,
  *                    NO commit.
@@ -104,13 +130,13 @@ const RECONCILE_WINDOW_MS = 600_000; // 10 min
 export async function reconcileLedgerRow(row, deps) {
     const { ledger, channel, replaySend, notify, nowMs, logger } = deps;
     const { rootRunId, stepIndex } = row;
-    // ONCE-02 — an already-committed row is a pure no-op (a re-scan must not
+    // An already-committed row is a pure no-op (a re-scan must not
     // re-query or re-send a confirmed send).
     if (row.state === "committed") {
         return ok(undefined);
     }
     // Build the content-free reconcile query — a contentDigest + a time window
-    // bracketed around the recovery time (never the body, T-216-17).
+    // bracketed around the recovery time (never the body).
     const now = nowMs();
     const query = {
         channelId: row.channelId,
@@ -118,7 +144,7 @@ export async function reconcileLedgerRow(row, deps) {
         sentAfterMs: now - RECONCILE_WINDOW_MS,
         sentBeforeMs: now + RECONCILE_WINDOW_MS,
     };
-    // ABSENCE of reconcileSend = unresolved (Pitfall 2). A channel that cannot tell
+    // ABSENCE of reconcileSend = unresolved. A channel that cannot tell
     // is parked + escalated, NEVER replayed.
     // prettier-ignore
     const outcomeResult = channel?.reconcileSend ? await channel.reconcileSend(query) : ok({ kind: "unresolved" });
@@ -164,7 +190,7 @@ export async function reconcileLedgerRow(row, deps) {
                 logger.info({ rootRunId, stepIndex, reconcileOutcome: "not_sent" }, "Durable reconcile: not_sent → replayed once");
                 return ok(undefined);
             }
-            // ONCE-04: a permanent error is terminal — markFailed, skip the retry budget.
+            // A permanent error is terminal — markFailed, skip the retry budget.
             if (isPermanentError(replayed.error.message)) {
                 const failed = await ledger.markFailed(rootRunId, stepIndex, "permanent");
                 if (!failed.ok)
@@ -205,16 +231,16 @@ function failLedger(logger, cause, method, rootRunId, stepIndex) {
 }
 const DEFAULT_BUDGET_REF = "durable-resume";
 export function createDurableResumeEngine(deps) {
-    const { durableRuns, ledger, channelFor, remintLease, resumeRun, replaySend, notify, nowMs, recoveryBudgetMs, logger, eventBus, } = deps;
-    /** Orphan a run: markOrphaned + NotifyFn + eventBus + INFO (never silent — DUR-02/HB-03). */
+    const { durableRuns, ledger, channelFor, remintLease, resumeRun, replaySend, notify, nowMs, recoveryBudgetMs, logger, eventBus, reclaimOrchestrateRun, } = deps;
+    /** Orphan a run: markOrphaned + NotifyFn + eventBus + INFO (never silent). */
     async function orphan(rootRunId, reason, hint) {
         const marked = await durableRuns.markOrphaned(rootRunId, reason);
         if (!marked.ok) {
             logger.error({ rootRunId, reason, errorKind: "dependency", err: marked.error, hint: "markOrphaned write failed — operator still notified out-of-band" }, "Durable resume: markOrphaned failed");
         }
         notify({ kind: "run_orphaned", rootRunId, reason, hint });
-        // FLEET-03: the EVENT carries the CLOSED enum (T-220-01) — the free-text
-        // `reason` stays on the notify + logger.info below (the operator surface).
+        // The EVENT carries the CLOSED enum — the free-text `reason` stays on the
+        // notify + logger.info below (the operator surface).
         eventBus.emit("durable:orphaned", {
             rootRunId,
             reason: orphanReasonToEnum(reason),
@@ -236,7 +262,7 @@ export function createDurableResumeEngine(deps) {
             let orphaned = 0;
             let attempted = 0;
             for (const candidate of backlog) {
-                // HB-02 — bounded recovery: stop when the wall-clock budget is spent; the
+                // Bounded recovery: stop when the wall-clock budget is spent; the
                 // remainder stays `running` so the watchdog / next boot picks them up. No
                 // thundering herd.
                 if (nowMs() > deadline) {
@@ -247,7 +273,7 @@ export function createDurableResumeEngine(deps) {
                 attempted++;
                 const rootRunId = candidate.rootRunId;
                 // Belt: re-read the record — a concurrent revoke may have flipped it to
-                // 'revoked' since listResumable (DUR-03). A non-running re-read is orphaned.
+                // 'revoked' since listResumable. A non-running re-read is orphaned.
                 const reread = await durableRuns.getByRootRun(rootRunId);
                 if (!reread.ok) {
                     await orphan(rootRunId, "re-read failed", "the checkpoint could not be re-read; verify the store");
@@ -260,9 +286,9 @@ export function createDurableResumeEngine(deps) {
                     orphaned++;
                     continue;
                 }
-                // DUR-03 cap-tamper guard: parse the re-read record (the closed
+                // Cap-tamper guard: parse the re-read record (the closed
                 // AgentCapability union + strictObject). A tampered superset / malformed
-                // record orphans — never re-minted. NEW-5: parseDurableRunRecord PERMITS
+                // record orphans — never re-minted. parseDurableRunRecord PERMITS
                 // stepIndex = -1, so a legitimate never-sent run PASSES and is resumed (the
                 // guard rejects only genuinely-malformed caps/records, never a legitimate
                 // never-sent run). The parsed result is THE authoritative `record` we
@@ -295,7 +321,7 @@ export function createDurableResumeEngine(deps) {
                     }
                 }
                 // Re-mint from the PERSISTED attenuated caps VERBATIM.
-                // DUR-03: rehydrate the persisted attenuated caps — do NOT re-attenuate
+                // Rehydrate the persisted attenuated caps — do NOT re-attenuate
                 // from a live parent (the persisted set IS the attenuated result; a
                 // re-attenuation against a stale/broadened parent would resurrect or
                 // broaden authority).
@@ -311,7 +337,7 @@ export function createDurableResumeEngine(deps) {
                 const resumeResult = await resumeRun(record, lease.leaseId);
                 if (resumeResult.ok) {
                     resumed++;
-                    // FLEET-03: numeric stepIndex + timestamp (content-free, §2.7).
+                    // Numeric stepIndex + timestamp (content-free per the §2.7 logging matrix).
                     eventBus.emit("durable:resumed", {
                         rootRunId,
                         stepIndex: record.stepIndex,
@@ -320,8 +346,19 @@ export function createDurableResumeEngine(deps) {
                     logger.info({ rootRunId, stepIndex: record.stepIndex, durationMs: nowMs() - runStart }, "Durable resume: run resumed");
                 }
                 else {
-                    await orphan(rootRunId, "resume failed", "the run could not be resumed from its checkpoint; inspect the cause and re-launch if needed");
+                    // Propagate the resume failure's specific reason (e.g. the orchestrate
+                    // arm's "not resumable: the checkpoint blob is gone") so the WARN log /
+                    // notify name WHY AND `orphanReasonToEnum` maps it to the fitting closed
+                    // member (a missing checkpoint → not_resumable) — the free text NEVER
+                    // crosses onto the event (content-free — INV-5).
+                    await orphan(rootRunId, resumeResult.error.message, "the run could not be resumed from its checkpoint; inspect the cause and re-launch if needed");
                     orphaned++;
+                    // RESUME-04 orphan-reclaim: a dead resumable orchestrate run has no
+                    // surviving runner to GC its workspace — reclaim its results/ + pinned
+                    // script now. Scoped + idempotent by the bound seam (a non-orchestrate
+                    // row is a no-op); absent ⇒ no reclaim.
+                    if (reclaimOrchestrateRun)
+                        await reclaimOrchestrateRun(record);
                     logger.warn({ rootRunId, stepIndex: record.stepIndex, errorKind: "internal", err: resumeResult.error, hint: "resumeRun returned err — orphaned + operator notified" }, "Durable resume: resumeRun failed → orphaned");
                 }
             }
@@ -331,9 +368,9 @@ export function createDurableResumeEngine(deps) {
     };
 }
 /**
- * Derive the agentId for the re-mint. The DurableRunRecord (Plan 01) does not
+ * Derive the agentId for the re-mint. The DurableRunRecord does not
  * carry a dedicated agentId field; the run's authority is keyed by rootRunId +
- * caps + leases, and the wiring's remintLease closure (Plan 07) resolves the
+ * caps + leases, and the wiring's remintLease closure resolves the
  * concrete agent from the lease/session context. We pass the rootRunId as a
  * stable correlation id so the mint is attributable; the closure may override.
  */

package/node_modules/@comis/daemon/dist/autonomy/durable-watchdog.d.ts

@@ -1,5 +1,5 @@
 /**
- * Durable watchdog (Phase 216, HB-01 / DUR-04): the PURE lapsed-heartbeat
+ * Durable watchdog: the PURE lapsed-heartbeat
  * detector. A long-running durable run stamps `lastHeartbeatAt` on a keep-alive
  * (DurableRunPort.touchHeartbeat); a process that crashed stops stamping, so a
  * run whose heartbeat is older than `staleHeartbeatMs` is a crash candidate the
@@ -8,11 +8,11 @@
  * This module is JUST the detector — `detectStaleRuns` is a pure filter with no
  * I/O and no callable-global time/timer reads (the globals.test.ts arch-gate
  * forbids the wall-clock global and the interval-scheduler global here). The
- * ACTUAL interval that calls it on a tick is wired in Plan 07 via the injected
- * TimerPort; `nowMs` is passed in by that caller so the detector stays
- * exhaustively unit-testable with a fake clock.
+ * ACTUAL interval that calls it on a tick is wired at the daemon boot layer via
+ * the injected TimerPort; `nowMs` is passed in by that caller so the detector
+ * stays exhaustively unit-testable with a fake clock.
  *
- * Pitfall 4 (the conservative-threshold rule): the threshold must be GENEROUSLY
+ * The conservative-threshold rule: the threshold must be GENEROUSLY
  * larger than the keep-alive interval, or a slow-but-alive run is falsely failed
  * and its work duplicated. This is the same lesson `ANNOUNCE_PARENT_TIMEOUT_MS`
  * encodes — "30s caused premature fallback + duplicate delivery"
@@ -24,7 +24,7 @@
 import type { DurableRunRecord } from "@comis/core";
 /**
  * The default keep-alive write cadence (ms) — how often a live durable run
- * stamps `lastHeartbeatAt`. Plan 07 schedules the touch at this interval.
+ * stamps `lastHeartbeatAt`. The daemon boot layer schedules the touch at this interval.
  */
 export declare const DEFAULT_KEEPALIVE_MS = 30000;
 /**
@@ -32,11 +32,11 @@ export declare const DEFAULT_KEEPALIVE_MS = 30000;
  * older than `nowMs - this` is treated as crashed. Deliberately 4x
  * {@link DEFAULT_KEEPALIVE_MS} (comfortably above the >=3x conservative-ratio
  * floor) so a transiently-slow run that misses a keep-alive or two is NOT failed
- * — the Pitfall-4 / `ANNOUNCE_PARENT_TIMEOUT_MS` "30s was too tight" lesson.
+ * — the conservative-ratio / `ANNOUNCE_PARENT_TIMEOUT_MS` "30s was too tight" lesson.
  */
 export declare const DEFAULT_STALE_HEARTBEAT_MS = 120000;
 /**
- * Detect the runs whose heartbeat has lapsed (HB-01).
+ * Detect the runs whose heartbeat has lapsed.
  *
  * A run is stale iff it is still `running` AND its last heartbeat is STRICTLY
  * older than the threshold (`lastHeartbeatAt < nowMs - staleHeartbeatMs`). The

package/node_modules/@comis/daemon/dist/autonomy/durable-watchdog.js

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * Durable watchdog (Phase 216, HB-01 / DUR-04): the PURE lapsed-heartbeat
+ * Durable watchdog: the PURE lapsed-heartbeat
  * detector. A long-running durable run stamps `lastHeartbeatAt` on a keep-alive
  * (DurableRunPort.touchHeartbeat); a process that crashed stops stamping, so a
  * run whose heartbeat is older than `staleHeartbeatMs` is a crash candidate the
@@ -9,11 +9,11 @@
  * This module is JUST the detector — `detectStaleRuns` is a pure filter with no
  * I/O and no callable-global time/timer reads (the globals.test.ts arch-gate
  * forbids the wall-clock global and the interval-scheduler global here). The
- * ACTUAL interval that calls it on a tick is wired in Plan 07 via the injected
- * TimerPort; `nowMs` is passed in by that caller so the detector stays
- * exhaustively unit-testable with a fake clock.
+ * ACTUAL interval that calls it on a tick is wired at the daemon boot layer via
+ * the injected TimerPort; `nowMs` is passed in by that caller so the detector
+ * stays exhaustively unit-testable with a fake clock.
  *
- * Pitfall 4 (the conservative-threshold rule): the threshold must be GENEROUSLY
+ * The conservative-threshold rule: the threshold must be GENEROUSLY
  * larger than the keep-alive interval, or a slow-but-alive run is falsely failed
  * and its work duplicated. This is the same lesson `ANNOUNCE_PARENT_TIMEOUT_MS`
  * encodes — "30s caused premature fallback + duplicate delivery"
@@ -24,7 +24,7 @@
  */
 /**
  * The default keep-alive write cadence (ms) — how often a live durable run
- * stamps `lastHeartbeatAt`. Plan 07 schedules the touch at this interval.
+ * stamps `lastHeartbeatAt`. The daemon boot layer schedules the touch at this interval.
  */
 export const DEFAULT_KEEPALIVE_MS = 30_000;
 /**
@@ -32,11 +32,11 @@ export const DEFAULT_KEEPALIVE_MS = 30_000;
  * older than `nowMs - this` is treated as crashed. Deliberately 4x
  * {@link DEFAULT_KEEPALIVE_MS} (comfortably above the >=3x conservative-ratio
  * floor) so a transiently-slow run that misses a keep-alive or two is NOT failed
- * — the Pitfall-4 / `ANNOUNCE_PARENT_TIMEOUT_MS` "30s was too tight" lesson.
+ * — the conservative-ratio / `ANNOUNCE_PARENT_TIMEOUT_MS` "30s was too tight" lesson.
  */
 export const DEFAULT_STALE_HEARTBEAT_MS = 120_000;
 /**
- * Detect the runs whose heartbeat has lapsed (HB-01).
+ * Detect the runs whose heartbeat has lapsed.
  *
  * A run is stale iff it is still `running` AND its last heartbeat is STRICTLY
  * older than the threshold (`lastHeartbeatAt < nowMs - staleHeartbeatMs`). The

package/node_modules/@comis/daemon/dist/autonomy/evict-registry.d.ts

@@ -1,25 +1,24 @@
 /**
- * `createEvictRegistry` — the daemon-wide evicted-`rootRunId` set (Phase 217-04,
- * EVICT-01/03).
+ * `createEvictRegistry` — the daemon-wide evicted-`rootRunId` set.
  *
  * The shared state between two seams:
  *   - the `autonomy.evict` admin RPC handler WRITES it (`mark(rootRunId)`) when an
- *     operator forcibly demotes an in-flight unattended run (EVICT-01), and
+ *     operator forcibly demotes an in-flight unattended run, and
  *   - the bounded-autonomy chokepoint READS it (`isEvicted(rootRunId)`) at the
- *     NEXT gate decision (EVICT-03 — mid-run, NOT at mint/next-spawn) to resolve
+ *     NEXT gate decision (mid-run, NOT at mint/next-spawn) to resolve
  *     the run's effective profile to `default`.
  *
  * Evict is semantically DISTINCT from revoke (cooperative stop) and kill (hard
  * stop): it DEMOTES — the run KEEPS GOING under the `default` profile (which still
  * escalates outward, never auto-sends), it does NOT abort. This registry is the
- * read/write primitive that makes that demotion mid-run-effective; the Wave-2
+ * read/write primitive that makes that demotion mid-run-effective; the
  * chokepoint wires the read side.
  *
  * Discipline (the daemon arch gates): the service NEVER throws; the logger is
  * injected (no module-level logger); logging is content-free (§2.7 — the method +
  * the newly/already enum only, NEVER the run's body — `rootRunId` is an id, not a
  * body). `clear(rootRunId)` is the run-end cleanup that keeps the backing set
- * bounded under a storm of completed roots (T-217-15) — mirrors the per-root map
+ * bounded under a storm of completed roots — mirrors the per-root map
  * eviction discipline `createBoundedAutonomy.releaseSpawn` follows for its sibling
  * per-root state.
  *
@@ -30,7 +29,7 @@ import type { ComisLogger } from "@comis/infra";
 export interface EvictRegistry {
     /**
      * Demote a run: mark its `rootRunId` so the chokepoint resolves its mode to
-     * `default` from the NEXT gate decision (EVICT-03). Idempotent — a second mark
+     * `default` from the NEXT gate decision. Idempotent — a second mark
      * of an already-evicted root is a no-op on the set. Returns `{ newlyEvicted }`
      * so the handler can report whether THIS call changed state (`true`) or the run
      * was already demoted (`false`).
@@ -40,20 +39,20 @@ export interface EvictRegistry {
     };
     /**
      * Is this run demoted? The read primitive the chokepoint consults BEFORE
-     * resolving the effective mode (EVICT-03). `false` for an unknown root.
+     * resolving the effective mode. `false` for an unknown root.
      */
     isEvicted(rootRunId: string): boolean;
     /**
      * Drop a run's evicted flag — the run-end cleanup. Idempotent (a clear of an
      * unknown root is a no-op). Keeps the backing set from growing unbounded under a
-     * churn of completed roots (T-217-15).
+     * churn of completed roots.
      */
     clear(rootRunId: string): void;
 }
 /**
  * Construct the evicted-`rootRunId` registry. Backed by a `Set<string>`; the
  * composition root constructs ONE per daemon and threads it onto the dispatch
- * deps (Plan 05, Wave 2) so the `autonomy.evict` handler (write) and the
+ * deps so the `autonomy.evict` handler (write) and the
  * chokepoint (read) share the same instance.
  *
  * @param deps.logger - structured logger for the content-free §2.7 mark line.

package/node_modules/@comis/daemon/dist/autonomy/evict-registry.js

@@ -1,7 +1,7 @@
 /**
  * Construct the evicted-`rootRunId` registry. Backed by a `Set<string>`; the
  * composition root constructs ONE per daemon and threads it onto the dispatch
- * deps (Plan 05, Wave 2) so the `autonomy.evict` handler (write) and the
+ * deps so the `autonomy.evict` handler (write) and the
  * chokepoint (read) share the same instance.
  *
  * @param deps.logger - structured logger for the content-free §2.7 mark line.
@@ -9,7 +9,7 @@
 export function createEvictRegistry(deps) {
     const logger = deps.logger.child({ submodule: "evict-registry" });
     // The evicted-rootRunId set. `clear` drops entries on run-end so a storm of
-    // completed roots cannot grow it without bound (T-217-15).
+    // completed roots cannot grow it without bound.
     const evicted = new Set();
     return {
         mark(rootRunId) {

package/node_modules/@comis/daemon/dist/autonomy/outward-quota.d.ts

@@ -1,23 +1,23 @@
 /**
- * Outward quota (QUOTA-01/02): the irreversible-action gate for agent-initiated
+ * Outward quota: the irreversible-action gate for agent-initiated
  * outward sends. An outward message is the visible/irreversible action an injected
  * agent could abuse (mass-DMing strangers, posting to a new public channel), so a
  * send is gated three ways:
  *
- *   1. channel allowance (QUOTA-01) — the origin channel is always allowed; a NEW
+ *   1. channel allowance — the origin channel is always allowed; a NEW
  *      target needs an explicit `perTargetGrants[]` entry, else deny `no_grant`.
- *   2. volume gate (QUOTA-02) — a high-volume / mass-recipient send over `volumeCap`
+ *   2. volume gate — a high-volume / mass-recipient send over `volumeCap`
  *      is denied even to origin, even when "reversible": a mass-DM blast stays gated.
  *   3. per-hour quota — a rolling-hour window keyed on `${agentId}:${channelId}`
  *      (the `notification/rate-limiter.ts` rolling-hour limb), deny `per_hour` over cap.
  *
  * `orch:browse` needs NO code here — it is the always-escalate capability with no
- * mapped tool in M1; it is simply not granted.
+ * mapped tool; it is simply not granted.
  *
  * Time is INJECTED via ClockPort — there is deliberately no wall-clock-global
  * fallback (the `notification/rate-limiter.ts:19` `?? <wall-clock-global>` hazard the
  * globals.test.ts arch-gate rejects). Returns Result<void, QuotaError>, never throws
- * (raw-throw.test.ts); the message-handler chokepoint (Plan 07) maps the err to a deny.
+ * (raw-throw.test.ts); the message-handler chokepoint maps the err to a deny.
  *
  * @module
  */
@@ -37,10 +37,10 @@ export interface OutwardQuota {
     tryOutward(agentId: string, channelId: string, isOrigin: boolean, volume: number): Result<void, QuotaError>;
     /**
      * The remaining per-hour send allowance for `${agentId}:${channelId}` in the
-     * LIVE rolling-hour window — a PURE read (INTRO-01, the headroom the
+     * LIVE rolling-hour window — a PURE read (the headroom the
      * `capabilities.introspect`/`whoami` RPC reports). LOAD-BEARING: it must NOT
      * `counters.set(...)` — the {@link OutwardQuota.tryOutward} path resets/advances
-     * the window, this accessor must NOT (T-215-05). It reads `clock.now()` ONLY to
+     * the window, this accessor must NOT. It reads `clock.now()` ONLY to
      * decide whether the stored window has expired. An unseen key OR an expired
      * window reports the FULL `maxPerHour` (the same fresh-window semantics
      * `tryOutward` would apply), without writing a window.
@@ -50,11 +50,11 @@ export interface OutwardQuota {
     };
 }
 export interface OutwardQuotaConfig {
-    /** Whether sends default to the origin channel only (QUOTA-01). */
+    /** Whether sends default to the origin channel only. */
     readonly originOnly: boolean;
     /** Explicit per-target grants — channels a new (non-origin) send may reach. */
     readonly perTargetGrants: readonly string[];
-    /** Max recipient count / size for a single send (QUOTA-02). */
+    /** Max recipient count / size for a single send. */
     readonly volumeCap: number;
     /** Max sends per `${agentId}:${channelId}` per rolling hour. */
     readonly maxPerHour: number;

package/node_modules/@comis/daemon/dist/autonomy/outward-quota.js

@@ -1,24 +1,24 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * Outward quota (QUOTA-01/02): the irreversible-action gate for agent-initiated
+ * Outward quota: the irreversible-action gate for agent-initiated
  * outward sends. An outward message is the visible/irreversible action an injected
  * agent could abuse (mass-DMing strangers, posting to a new public channel), so a
  * send is gated three ways:
  *
- *   1. channel allowance (QUOTA-01) — the origin channel is always allowed; a NEW
+ *   1. channel allowance — the origin channel is always allowed; a NEW
  *      target needs an explicit `perTargetGrants[]` entry, else deny `no_grant`.
- *   2. volume gate (QUOTA-02) — a high-volume / mass-recipient send over `volumeCap`
+ *   2. volume gate — a high-volume / mass-recipient send over `volumeCap`
  *      is denied even to origin, even when "reversible": a mass-DM blast stays gated.
  *   3. per-hour quota — a rolling-hour window keyed on `${agentId}:${channelId}`
  *      (the `notification/rate-limiter.ts` rolling-hour limb), deny `per_hour` over cap.
  *
  * `orch:browse` needs NO code here — it is the always-escalate capability with no
- * mapped tool in M1; it is simply not granted.
+ * mapped tool; it is simply not granted.
  *
  * Time is INJECTED via ClockPort — there is deliberately no wall-clock-global
  * fallback (the `notification/rate-limiter.ts:19` `?? <wall-clock-global>` hazard the
  * globals.test.ts arch-gate rejects). Returns Result<void, QuotaError>, never throws
- * (raw-throw.test.ts); the message-handler chokepoint (Plan 07) maps the err to a deny.
+ * (raw-throw.test.ts); the message-handler chokepoint maps the err to a deny.
  *
  * @module
  */
@@ -30,7 +30,7 @@ export function createOutwardQuota(deps) {
     const counters = new Map();
     return {
         tryOutward(agentId, channelId, isOrigin, volume) {
-            // 1. Channel allowance (QUOTA-01): origin always allowed; a new target needs
+            // 1. Channel allowance: origin always allowed; a new target needs
             //    an explicit grant. `originOnly` is the default posture; a grant is the
             //    only escape for a non-origin channel.
             if (!isOrigin && !config.perTargetGrants.includes(channelId)) {
@@ -42,7 +42,7 @@ export function createOutwardQuota(deps) {
                 }, "Outward send denied: no per-target grant for a non-origin channel");
                 return err({ reason: "no_grant" });
             }
-            // 2. Volume gate (QUOTA-02): a high-volume / mass-recipient send is gated even
+            // 2. Volume gate: a high-volume / mass-recipient send is gated even
             //    to the origin channel — a reversible mass-DM blast is still bounded.
             if (volume > config.volumeCap) {
                 logger.warn({
@@ -77,7 +77,7 @@ export function createOutwardQuota(deps) {
             return ok(undefined);
         },
         remaining(agentId, channelId) {
-            // PURE read (INTRO-01 / T-215-05): NO counters.set. `deps.clock.now()` is
+            // PURE read: NO counters.set. `deps.clock.now()` is
             // read ONLY to decide if the stored window has expired (the same window-roll
             // boundary `tryOutward` uses), never to WRITE a window.
             const now = deps.clock.now();