comisai 1.0.45 → 1.0.46

package/node_modules/@comis/daemon/dist/autonomy/per-root-budget.d.ts

@@ -1,38 +1,38 @@
 /**
- * The per-`rootRunId` aggregate budget meter (Phase 213-04, BUDGET-01/02/03) —
- * the cost-bound limb of the bounded-autonomy floor.
+ * The per-`rootRunId` aggregate budget meter — the cost-bound limb of the
+ * bounded-autonomy floor.
  *
  * A self-spawning loop is aborted on ANY of three limbs — $ / token / wall-clock —
  * keyed on the tree root (`rootRunId`), a DISTINCT scope from the daemon-wide
- * per-`(tenant,agent)` {@link SpendAccumulator} (RESEARCH §C). The $-limb REUSES
- * the shipped v2.28 3-state pricing gate {@link checkSpendCeiling} VERBATIM
- * (re-scoped to `{ tenantId: "_root", agentId: rootRunId }`), so the ffe11736
+ * per-`(tenant,agent)` {@link SpendAccumulator}. The $-limb REUSES
+ * the 3-state pricing gate {@link checkSpendCeiling} VERBATIM
+ * (re-scoped to `{ tenantId: "_root", agentId: rootRunId }`), so the
  * fail-closed semantics are inherited, NOT re-implemented:
  *   - a local/gateway-`free` model → `{ kind: "free" }`, NEVER trips the $-cap
  *     (a local-first deployment is not falsely DoSed),
  *   - a native-provider `unknown`-priced model that burned tokens → `{ kind:
- *     "unpriceable" }` — the $-cap REFUSES (BUDGET-03), never a phantom $0,
+ *     "unpriceable" }` — the $-cap REFUSES, never a phantom $0,
  *   - a priced model → the atomic per-root $ reserve.
  *
- * The NET-NEW value over the shipped gate is the per-root scope plus TWO limbs
- * that enforce REGARDLESS of pricing — so a zero-price (subscription/Codex)
- * native-provider loop, where the $-cap can never bite, STILL trips (BUDGET-02):
+ * The NET-NEW value over the base gate is the per-root scope plus TWO limbs
+ * that enforce REGARDLESS of pricing — so a zero-price (subscription) native-
+ * provider loop, where the $-cap can never bite, STILL trips:
  *   - a TOKEN limb: the per-root running token total vs `config.tokens`,
  *   - a per-root WALL-CLOCK deadline: `clock.now() - rootStartMs > config.wallClockMs`
  *     (the anchor is set at {@link PerRootBudget.registerRoot}, NOT per call —
- *     it bounds the whole tree's elapsed time, RESEARCH Pitfall 4).
+ *     it bounds the whole tree's elapsed time).
  *
  * Discipline (the daemon arch gates): all time is the injected {@link ClockPort}
  * (NEVER `Date.now` — the `globals.test.ts` gate); the meter returns a
  * {@link SpendGateOutcome}, NEVER throwing (`raw-throw.test.ts` — the chokepoint
- * converts an `exceeded` outcome to a turn abort in Plan 08); content-free — it
+ * converts an `exceeded` outcome to a turn abort); content-free — it
  * operates on token/dollar COUNTS keyed by an opaque `rootRunId` only.
  *
  * @module
  */
 import type { ClockPort, ComisLogger } from "@comis/core";
-import { type SpendGateOutcome } from "@comis/agent";
-/** The per-root budget surface (the composite `BoundedAutonomy` holds one — Plan 06). */
+import { type SpendGateOutcome, type SpendLimb, type SpendUnit } from "@comis/agent";
+/** The per-root budget surface (the composite `BoundedAutonomy` holds one). */
 export interface PerRootBudget {
     /**
      * Register a tree root, anchoring its wall-clock deadline at `clock.now()`. Idempotent —
@@ -41,22 +41,22 @@ export interface PerRootBudget {
      */
     registerRoot(rootRunId: string): void;
     /**
-     * Evict a completed root's accounting (WR-05): drop its wall-clock anchor and
+     * Evict a completed root's accounting: drop its wall-clock anchor and
      * running token total so a `for(;;) spawn()` / cron storm of distinct roots
      * does not grow these maps without bound. Idempotent — a no-op for an unknown
      * root, never throws. A later `registerRoot` of the same id starts fresh.
      *
-     * NOTE: the per-root $-accumulator is a shipped daemon-lifetime
+     * NOTE: the per-root $-accumulator is a daemon-lifetime
      * {@link SpendAccumulator} with no per-scope eviction API; its per-root scope
-     * map is NOT pruned here (evicting it would touch shipped v2.28 spend
+     * map is NOT pruned here (evicting it would touch the shared spend
      * semantics). The token + wall-clock maps owned by THIS module — the two
-     * unbounded vectors 213-REVIEW WR-05 names — are the ones evicted.
+     * unbounded vectors — are the ones evicted.
      */
     evictRoot(rootRunId: string): void;
     /**
      * Reserve budget for one LLM/web call against the tree root. Runs the wall-clock
      * and token limbs FIRST (they enforce regardless of pricing — the limbs that bite
-     * a zero-price loop), then the $-limb via the SHIPPED 3-state gate. Returns a
+     * a zero-price loop), then the $-limb via the existing 3-state gate. Returns a
      * {@link SpendGateOutcome}: `ok` (reserved) | `free` (local — never $-trips) |
      * `unpriceable` (native unknown-priced — the $-cap refuses) | `exceeded` (a limb
      * breached — the chokepoint aborts the turn).
@@ -64,29 +64,33 @@ export interface PerRootBudget {
      * @param rootRunId the tree root the spend accrues to (scope `agentId`).
      * @param provider the LLM/web provider id (consumed by the 3-state pricing gate).
      * @param model the model id at the provider (consumed by the 3-state pricing gate).
-     * @param estUsd the conservative estimated dollars for this call (the $-limb).
+     * @param estUsd the dollars this call accrues into the $-limb. The accumulator
+     *   has NO separate actual-adder and nothing reconciles a reserve after the
+     *   fact — whatever is passed here IS the root's recorded spend, so callers
+     *   pass the actual billed cost when known (the bridge reserves post-record).
+     *   A worst-case estimate here permanently consumes the ceiling.
      * @param estTokens the estimated tokens for this call (the token limb + the
      *   `burnedTokens` discriminator the 3-state gate reads).
      */
     reserveBudget(rootRunId: string, provider: string, model: string, estUsd: number, estTokens: number): SpendGateOutcome;
     /**
-     * The per-root remaining headroom on all three limbs — a PURE read (INTRO-01,
-     * the source the `capabilities.introspect`/`whoami` RPC reports). NO mutation:
+     * The per-root remaining headroom on all three limbs — a PURE read (the source
+     * the `capabilities.introspect`/`whoami` RPC reports). NO mutation:
      * it does NOT anchor a wall-clock window, advance the token total, or reserve $
      * (unlike {@link PerRootBudget.reserveBudget}); it reads `clock.now()` ONLY to
-     * compute the live elapsed window (T-215-05).
+     * compute the live elapsed window.
      *
      *   - `tokensRemaining`   = `config.tokens - <accumulated tokens>` (≥ 0).
      *   - `wallClockMsRemaining` = `config.wallClockMs - (clock.now() - rootStartMs)`
      *     (≥ 0). An UNREGISTERED root has no anchor → the FULL allowance is reported
      *     and NO anchor is written (the read never starts the clock).
      *   - `usdRemaining` = `config.aggregateUsd - <priced spend>` from the SAME
-     *     `perRootUsdAccumulator` the $-gate enforces against (A3 RESOLVED — a REAL
-     *     number, so the read matches the gate, T-215-06). It is `number | null` on
+     *     `perRootUsdAccumulator` the $-gate enforces against (a REAL
+     *     number, so the read matches the gate). It is `number | null` on
      *     the type for the honest-degrade contract; the impl returns a real number.
      *     CAVEAT: the accumulator total reflects only PRICED spend — if a node hit
      *     an unpriceable model the $ figure is "priced-spend only", but the
-     *     token/wall-clock limbs remain authoritative regardless (BUDGET-02).
+     *     token/wall-clock limbs remain authoritative regardless.
      */
     remaining(rootRunId: string): {
         tokensRemaining: number;
@@ -101,7 +105,7 @@ export interface PerRootBudget {
  *
  * Constructs a SEPARATE {@link SpendAccumulator} keyed on `rootRunId` (via the
  * `{ tenantId: "_root", agentId: rootRunId }` scope) — it does NOT reuse the
- * daemon-wide accumulator instance (a DIFFERENT scope; RESEARCH §C scope gap).
+ * daemon-wide accumulator instance (a DIFFERENT scope).
  * Only the per-(tenant,agent) dimension is active (the per-root $-cap); the tenant
  * + daemon-global dimensions are off (`null`) here — the daemon-wide accumulator
  * owns those.
@@ -114,4 +118,18 @@ export declare function createPerRootBudget(deps: {
         wallClockMs: number;
     };
     logger: ComisLogger;
+    /**
+     * Fired ONCE per (root, limb) when a limb crosses {@link WARN_FRACTION} of
+     * its cap — the PRE-TRIP signal (the wiring emits `autonomy:budget_warning`
+     * so the fleet lens sees a session approaching its budget BEFORE the abort
+     * wedges it). Re-armed by {@link PerRootBudget.evictRoot}. Optional — absent
+     * ⇒ no warning surface (existing callers unchanged).
+     */
+    onLimbWarning?: (w: {
+        rootRunId: string;
+        limb: SpendLimb;
+        spent: number;
+        cap: number;
+        unit: SpendUnit;
+    }) => void;
 }): PerRootBudget;

package/node_modules/@comis/daemon/dist/autonomy/per-root-budget.js

@@ -6,7 +6,7 @@ import { checkSpendCeiling, createSpendAccumulator, SpendError, } from "@comis/a
  *
  * Constructs a SEPARATE {@link SpendAccumulator} keyed on `rootRunId` (via the
  * `{ tenantId: "_root", agentId: rootRunId }` scope) — it does NOT reuse the
- * daemon-wide accumulator instance (a DIFFERENT scope; RESEARCH §C scope gap).
+ * daemon-wide accumulator instance (a DIFFERENT scope).
  * Only the per-(tenant,agent) dimension is active (the per-root $-cap); the tenant
  * + daemon-global dimensions are off (`null`) here — the daemon-wide accumulator
  * owns those.
@@ -17,24 +17,38 @@ export function createPerRootBudget(deps) {
     // Per-root wall-clock anchors + token running totals.
     const rootStartMs = new Map();
     const tokenTotals = new Map();
+    // Pre-trip warn threshold + the once-per-(root,limb) guards. Cleared on
+    // evictRoot so a re-registered root warns afresh.
+    const WARN_FRACTION = 0.8;
+    const warnedLimbs = new Map();
+    function warnLimb(rootRunId, limb, spent, cap, unit) {
+        if (deps.onLimbWarning === undefined)
+            return;
+        const limbs = warnedLimbs.get(rootRunId) ?? new Set();
+        if (limbs.has(limb))
+            return;
+        limbs.add(limb);
+        warnedLimbs.set(rootRunId, limbs);
+        deps.onLimbWarning({ rootRunId, limb, spent, cap, unit });
+    }
     // A SEPARATE per-root $ accumulator — the per-(tenant,agent) dimension is the
     // per-root $-cap (scope agentId=rootRunId); tenant/global are off (the
-    // daemon-wide accumulator owns those). warnAtFraction is set at the cap (1) so
-    // a granted reserve carries no warn — this meter has no bus wiring (Plan 08
-    // routes only the `exceeded` outcome).
+    // daemon-wide accumulator owns those). warnAtFraction matches WARN_FRACTION:
+    // a granted reserve past the threshold carries `warn`, which reserveBudget
+    // routes to the once-per-(root,limb) onLimbWarning — the pre-trip signal.
     const perRootUsdAccumulator = createSpendAccumulator({
         clock,
         ceilings: {
             perAgentUsd: config.aggregateUsd,
             perTenantUsd: null,
             daemonGlobalUsd: null,
-            warnAtFraction: 1,
+            warnAtFraction: WARN_FRACTION,
         },
     });
     // The 3-state gate's config: a transient pricing-resolve throw falls back to the
     // snapshot (treat as priced) and STILL enforces — never fail-open. onUnknownPricing
     // is "abort" so the unknown-priced surface is treated as the danger it is (the
-    // bridge in Plan 08 acts on the unpriceable outcome).
+    // bridge acts on the unpriceable outcome).
     const spendCfg = {
         onUnknownPricing: "abort",
         pricingFallback: "snapshot",
@@ -46,27 +60,31 @@ export function createPerRootBudget(deps) {
             }
         },
         evictRoot(rootRunId) {
-            // WR-05: drop the two unbounded maps this module owns. Bounded by the
+            // Drop the unbounded maps this module owns. Bounded by the
             // semaphore's release-to-zero hook (the composite calls this then).
             rootStartMs.delete(rootRunId);
             tokenTotals.delete(rootRunId);
+            warnedLimbs.delete(rootRunId);
         },
         reserveBudget(rootRunId, provider, model, estUsd, estTokens) {
             // ── Limb 1: WALL-CLOCK (enforced regardless of pricing). ──
             // Anchor: the root's registration time, or now() for an unregistered root.
-            // IN-02 (213-REVIEW): PERSIST the anchor on the first reserve for an unknown
+            // PERSIST the anchor on the first reserve for an unknown
             // root, so the deadline measures from this FIRST call onward (matching the
             // documented "a call before registerRoot anchors here so the deadline still
             // bounds it" intent). Without the write, every call for an unregistered
             // root re-anchored at now() → elapsedMs stayed ~0 and the wall-clock limb
             // could NEVER fire (the token limb still gated, but the wall-clock backstop
-            // was silently inert). This also covers a root re-used after WR-05 eviction.
+            // was silently inert). This also covers a root re-used after eviction.
             let startMs = rootStartMs.get(rootRunId);
             if (startMs === undefined) {
                 startMs = clock.now();
                 rootStartMs.set(rootRunId, startMs);
             }
             const elapsedMs = clock.now() - startMs;
+            if (elapsedMs <= config.wallClockMs && elapsedMs >= WARN_FRACTION * config.wallClockMs) {
+                warnLimb(rootRunId, "wallClockMs", elapsedMs, config.wallClockMs, "ms");
+            }
             if (elapsedMs > config.wallClockMs) {
                 logger.warn({ rootRunId, elapsedMs, capMs: config.wallClockMs, errorKind: "resource" }, "Per-root wall-clock budget exceeded");
                 // SpendError carries the limb's own (current, cap, est) in ms — scope
@@ -82,28 +100,50 @@ export function createPerRootBudget(deps) {
                 return { kind: "exceeded", error: new SpendError("agent", priorTokens, config.tokens, estTokens, "tokens", "tokens") };
             }
             tokenTotals.set(rootRunId, nextTokens);
-            // ── Limb 3: $ via the SHIPPED 3-state gate (free→never trips; unknown+burn→
+            if (nextTokens >= WARN_FRACTION * config.tokens) {
+                warnLimb(rootRunId, "tokens", nextTokens, config.tokens, "tokens");
+            }
+            // ── Limb 3: $ via the existing 3-state gate (free→never trips; unknown+burn→
             // unpriceable/refuse; priced→atomic per-root reserve). burnedTokens = the
             // call actually consumed tokens. ──
             const r = checkSpendCeiling(perRootUsdAccumulator, { tenantId: "_root", agentId: rootRunId }, provider, model, estUsd, spendCfg, 
             /* burnedTokens */ estTokens > 0);
             // checkSpendCeiling returns ok(...) on every branch (the breach is an
             // `exceeded` outcome, not an err); the Result err arm is defensive.
-            return r.ok ? r.value : { kind: "exceeded", error: r.error };
+            const outcome = r.ok ? r.value : { kind: "exceeded", error: r.error };
+            // The granted-reserve warn from the 3-state gate (post-reserve fraction
+            // >= WARN_FRACTION) is the $-limb's pre-trip signal.
+            if (outcome.kind === "ok" && outcome.warn !== null && outcome.warn !== undefined) {
+                warnLimb(rootRunId, "aggregateUsd", outcome.warn.totalUsd, outcome.warn.capUsd, "usd");
+            }
+            // Brand a $-limb trip with its limb identity. The gate's SpendError is
+            // shared with the daemon-wide observability.spend ceiling and carries no
+            // limb; without it the execution.aborted event has no perRootBudget
+            // payload for exactly this limb, and the explain spend verdict points
+            // the operator at observability.spend.* — the wrong knob tree for a
+            // per-root trip (the knob is autonomy.budget.aggregateUsd). The token
+            // and wall-clock limbs above already self-identify.
+            if (outcome.kind === "exceeded" && outcome.error.limb === undefined) {
+                return {
+                    kind: "exceeded",
+                    error: new SpendError(outcome.error.scope, outcome.error.currentUsd, outcome.error.capUsd, outcome.error.estUsd, "aggregateUsd", "usd"),
+                };
+            }
+            return outcome;
         },
         remaining(rootRunId) {
-            // PURE read (INTRO-01 / T-215-05): NO rootStartMs.set, NO tokenTotals.set,
+            // PURE read: NO rootStartMs.set, NO tokenTotals.set,
             // NO reserve. `clock.now()` is read ONLY to compute the live elapsed window.
             const usedTokens = tokenTotals.get(rootRunId) ?? 0;
             const startMs = rootStartMs.get(rootRunId);
             // An unregistered root has no anchor → 0 elapsed (full wall-clock allowance);
             // the read does NOT anchor a window (unlike reserveBudget's first-call write).
             const elapsedMs = startMs === undefined ? 0 : clock.now() - startMs;
-            // A3 RESOLVED: the $ remaining is computed from the SAME per-root accumulator
+            // The $ remaining is computed from the SAME per-root accumulator
             // the $-gate enforces against — `aggregateUsd` minus the per-root scope's
             // recorded (priced) spend. The scope key is `_root ${rootRunId}` (the
             // `${tenantId} ${agentId}` format `agentKeyOf` uses, tenantId "_root"). A
-            // REAL number, so the read matches the gate (T-215-06).
+            // REAL number, so the read matches the gate.
             const usedUsd = perRootUsdAccumulator.getSnapshot().perAgent.get(`_root ${rootRunId}`) ?? 0;
             return {
                 tokensRemaining: Math.max(0, config.tokens - usedTokens),

package/node_modules/@comis/daemon/dist/autonomy/root-run-semaphore.d.ts

@@ -1,16 +1,16 @@
 /**
- * The unified per-`rootRunId` spawn semaphore (Phase 213-04, CEIL-01) — the
- * structural runaway-bound of the bounded-autonomy floor.
+ * The unified per-`rootRunId` spawn semaphore — the structural runaway-bound of
+ * the bounded-autonomy floor.
  *
- * A `for(;;) spawn()` fork-bomb (the Claude Code #68619 4M-token precedent) is
- * bounded TREE-WIDE here: the active sub-agent count is keyed on `rootRunId` (the
- * tree root), NOT per caller, so every descendant of one root shares a single
- * counter and a self-spawning loop trips the concurrency cap instead of running
- * unbounded. This is an ADDITIONAL gate the chokepoints consult at the spawn
- * convergence point (Plan 07) — it does NOT replace the graph `gatedSpawn` FIFO
- * (`graph/graph-concurrency.ts`, whose `globalCompletionHandler` explicitly
- * ignores `sessions_spawn` runs — that IS the CEIL-01 gap); the two counters stay
- * independent.
+ * A `for(;;) spawn()` fork-bomb — an agent that recursively spawns until it burns
+ * millions of tokens — is bounded TREE-WIDE here: the active sub-agent count is
+ * keyed on `rootRunId` (the tree root), NOT per caller, so every descendant of
+ * one root shares a single counter and a self-spawning loop trips the concurrency
+ * cap instead of running unbounded. This is an ADDITIONAL gate the chokepoints
+ * consult at the spawn convergence point — it does NOT replace the graph
+ * `gatedSpawn` FIFO (`graph/graph-concurrency.ts`, whose `globalCompletionHandler`
+ * explicitly ignores `sessions_spawn` runs — that IS the gap this closes); the
+ * two counters stay independent.
  *
  * The admit-or-deny shape mirrors `gatedSpawn` (`graph-concurrency.ts:20`); the
  * reserve mirrors the `spend-accumulator.ts:228` discipline — a SYNCHRONOUS body
@@ -21,7 +21,7 @@
  *
  * Discipline (the daemon arch gates): returns a discriminated union, NEVER throws
  * (`raw-throw.test.ts` — the chokepoint converts `{ok:false}` to a deny + a
- * `session:sub_agent_spawn_rejected` event in Plan 07); touches no wall
+ * `session:sub_agent_spawn_rejected` event); touches no wall
  * clock / timer (`globals.test.ts`). It is a pure in-memory limiter — content-free
  * (it operates on COUNTS keyed by an opaque `rootRunId` only).
  *
@@ -53,13 +53,13 @@ export interface RootRunSemaphore {
      * Release one concurrency slot for `rootRunId`, paired one-to-one with a prior
      * successful `tryAcquireSpawn`. Floors at 0 — a double-release never drives the
      * active count negative (which would corrupt the cap into "free forever"). When
-     * the count reaches 0 the root's map entry is EVICTED (WR-05) so a storm of
+     * the count reaches 0 the root's map entry is EVICTED so a storm of
      * per-spawn roots that all complete does not grow the map without bound.
      */
     releaseSpawn(rootRunId: string): void;
     /** The live sub-agent count for `rootRunId` (0 for an untouched OR evicted root) — for the composite/audit + tests. */
     activeCount(rootRunId: string): number;
-    /** Number of distinct roots currently held (WR-05 leak-guard seam / tests). */
+    /** Number of distinct roots currently held (leak-guard seam / tests). */
     size(): number;
 }
 /**

package/node_modules/@comis/daemon/dist/autonomy/root-run-semaphore.js

@@ -1,17 +1,17 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * The unified per-`rootRunId` spawn semaphore (Phase 213-04, CEIL-01) — the
- * structural runaway-bound of the bounded-autonomy floor.
+ * The unified per-`rootRunId` spawn semaphore — the structural runaway-bound of
+ * the bounded-autonomy floor.
  *
- * A `for(;;) spawn()` fork-bomb (the Claude Code #68619 4M-token precedent) is
- * bounded TREE-WIDE here: the active sub-agent count is keyed on `rootRunId` (the
- * tree root), NOT per caller, so every descendant of one root shares a single
- * counter and a self-spawning loop trips the concurrency cap instead of running
- * unbounded. This is an ADDITIONAL gate the chokepoints consult at the spawn
- * convergence point (Plan 07) — it does NOT replace the graph `gatedSpawn` FIFO
- * (`graph/graph-concurrency.ts`, whose `globalCompletionHandler` explicitly
- * ignores `sessions_spawn` runs — that IS the CEIL-01 gap); the two counters stay
- * independent.
+ * A `for(;;) spawn()` fork-bomb — an agent that recursively spawns until it burns
+ * millions of tokens — is bounded TREE-WIDE here: the active sub-agent count is
+ * keyed on `rootRunId` (the tree root), NOT per caller, so every descendant of
+ * one root shares a single counter and a self-spawning loop trips the concurrency
+ * cap instead of running unbounded. This is an ADDITIONAL gate the chokepoints
+ * consult at the spawn convergence point — it does NOT replace the graph
+ * `gatedSpawn` FIFO (`graph/graph-concurrency.ts`, whose `globalCompletionHandler`
+ * explicitly ignores `sessions_spawn` runs — that IS the gap this closes); the
+ * two counters stay independent.
  *
  * The admit-or-deny shape mirrors `gatedSpawn` (`graph-concurrency.ts:20`); the
  * reserve mirrors the `spend-accumulator.ts:228` discipline — a SYNCHRONOUS body
@@ -22,7 +22,7 @@
  *
  * Discipline (the daemon arch gates): returns a discriminated union, NEVER throws
  * (`raw-throw.test.ts` — the chokepoint converts `{ok:false}` to a deny + a
- * `session:sub_agent_spawn_rejected` event in Plan 07); touches no wall
+ * `session:sub_agent_spawn_rejected` event); touches no wall
  * clock / timer (`globals.test.ts`). It is a pure in-memory limiter — content-free
  * (it operates on COUNTS keyed by an opaque `rootRunId` only).
  *
@@ -36,8 +36,8 @@
  */
 export function createRootRunSemaphore(cfg) {
     // In-memory per-tree active counts, keyed on rootRunId (ONE entry per tree —
-    // never one per spawn; the warning sign of a mis-scoped counter, RESEARCH
-    // Pitfall 1).
+    // never one per spawn; one entry per spawn would be the warning sign of a
+    // mis-scoped counter).
     const roots = new Map();
     return {
         tryAcquireSpawn(rootRunId, depth, fanout) {
@@ -61,7 +61,7 @@ export function createRootRunSemaphore(cfg) {
             if (!s)
                 return;
             s.active = Math.max(0, s.active - 1);
-            // WR-05: evict the entry once the tree has no live spawns, so a storm of
+            // Evict the entry once the tree has no live spawns, so a storm of
             // per-spawn / per-cron-fire roots that all complete does not accumulate
             // 0-active husks forever (the unbounded-key DoS vector). A later spawn for
             // the same id simply re-creates the entry at active=1 (the cap is unchanged).

package/node_modules/@comis/daemon/dist/config/audit-hook.d.ts

@@ -37,12 +37,12 @@
  * (`process.pid` / `process.ppid` / `process.argv` / `process.cwd()` /
  * `process.execArgv`) live inside `buildBaseFromProcess` and execute
  * at function-call time, not module-init, so per-record provenance is
- * captured correctly when the daemon forks/execs (RESEARCH §A.7 #1).
+ * captured correctly when the daemon forks/execs.
  *
  * Audit-append failures NEVER abort the underlying write — the sync
- * path uses a bare try/catch (mirroring the pre-refactor LKG semantic);
- * the async path uses `suppressError` (mirroring the pre-refactor
- * config-write semantic). The JSONL log is a forensics aid; the file
+ * path uses a bare try/catch (matching the LKG write path's error
+ * handling); the async path uses `suppressError` (matching the
+ * config-write path's). The JSONL log is a forensics aid; the file
  * write itself is the load-bearing artifact.
  *
  * @module
@@ -96,7 +96,7 @@ export interface WithAuditHookParams {
      * Resolved entry-script path of the calling module (typically
      * `fileURLToPath(import.meta.url)`). The caller must pass it
      * explicitly because reading `import.meta.url` here would resolve
-     * to audit-hook.ts, not the caller — see RESEARCH §A.7 #2.
+     * to audit-hook.ts, not the caller.
      */
     readonly entryScript: string;
     /**

package/node_modules/@comis/daemon/dist/config/audit-hook.js

@@ -38,12 +38,12 @@
  * (`process.pid` / `process.ppid` / `process.argv` / `process.cwd()` /
  * `process.execArgv`) live inside `buildBaseFromProcess` and execute
  * at function-call time, not module-init, so per-record provenance is
- * captured correctly when the daemon forks/execs (RESEARCH §A.7 #1).
+ * captured correctly when the daemon forks/execs.
  *
  * Audit-append failures NEVER abort the underlying write — the sync
- * path uses a bare try/catch (mirroring the pre-refactor LKG semantic);
- * the async path uses `suppressError` (mirroring the pre-refactor
- * config-write semantic). The JSONL log is a forensics aid; the file
+ * path uses a bare try/catch (matching the LKG write path's error
+ * handling); the async path uses `suppressError` (matching the
+ * config-write path's). The JSONL log is a forensics aid; the file
  * write itself is the load-bearing artifact.
  *
  * @module
@@ -61,7 +61,7 @@ import { createConfigWriteAuditRecordBase, finalizeConfigWriteAuditRecord, appen
  * Per-call (not module-init) reads of `process.pid` / `process.ppid` /
  * `process.argv` / `process.cwd()` / `process.execArgv` so per-record
  * provenance is correct even if the daemon forks/execs after this
- * module loads (RESEARCH §A.7 #1).
+ * module loads.
  */
 function buildBaseFromProcess(params) {
     try {
@@ -110,7 +110,7 @@ export function buildConfigAuditBase(localPath, callerSource = "config-patch-rpc
     // so the heuristic would false-positive without this hint. The
     // current file path contains "comis" (it lives under
     // packages/daemon/src/config/) so reading import.meta.url here
-    // satisfies the heuristic identically to the pre-refactor module.
+    // satisfies the heuristic.
     return buildBaseFromProcess({
         source: callerSource,
         configPath: localPath,

package/node_modules/@comis/daemon/dist/config/bootstrap-observe.d.ts

@@ -10,7 +10,7 @@ import { type ConfigFileObservation } from "./read-config-file-observation.js";
 /** Parameters for `emitBootstrapConfigObserveRecords`. */
 export interface EmitBootstrapConfigObserveRecordsParams {
     /**
-     * §9.2 file-state observations, one per *requested* config path
+     * File-state observations, one per *requested* config path
      * (NOT one per existing path — missing paths produce `exists:false`
      * records). Built by the daemon's `readConfigFileObservation`
      * aggregator BEFORE the `existsSync` filter at the call site.
@@ -41,7 +41,7 @@ export interface EmitBootstrapConfigObserveRecordsParams {
     readonly confinedBaseDir?: string;
 }
 /**
- * Aggregate the bootstrap config-read step: build §9.2 observations
+ * Aggregate the bootstrap config-read step: build observations
  * for every requested path (BEFORE the existsSync filter), filter
  * existing paths for the actual bootstrap call, run `_bootstrap`,
  * build the coarse per-path validity map, and emit the
@@ -83,7 +83,7 @@ export declare function runConfigBootstrapAndEmitObserve<TBoot>(params: {
 /**
  * Emit one `event: "config.observe"` audit-log record per observation
  * (one per *requested* config path, including missing ones). Each
- * record carries the design-§9.2 forensics shape projected from the
+ * record carries the forensics shape projected from the
  * observation cluster (file-stat block + LKG triple + backup triple)
  * plus the per-path validity bit.
  *

package/node_modules/@comis/daemon/dist/config/bootstrap-observe.js

@@ -12,7 +12,7 @@ import { existsSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { readConfigFileObservation } from "./read-config-file-observation.js";
 /**
- * Aggregate the bootstrap config-read step: build §9.2 observations
+ * Aggregate the bootstrap config-read step: build observations
  * for every requested path (BEFORE the existsSync filter), filter
  * existing paths for the actual bootstrap call, run `_bootstrap`,
  * build the coarse per-path validity map, and emit the
@@ -38,7 +38,7 @@ export async function runConfigBootstrapAndEmitObserve(params) {
 /**
  * Emit one `event: "config.observe"` audit-log record per observation
  * (one per *requested* config path, including missing ones). Each
- * record carries the design-§9.2 forensics shape projected from the
+ * record carries the forensics shape projected from the
  * observation cluster (file-stat block + LKG triple + backup triple)
  * plus the per-path validity bit.
  *

package/node_modules/@comis/daemon/dist/config/read-config-file-observation.d.ts

@@ -1,6 +1,6 @@
 /**
  * `readConfigFileObservation` — daemon-side aggregator that produces the
- * design-§9.2 file-state observation for one config path.
+ * file-state observation for one config path.
  *
  * Returns a `ConfigFileObservation` containing snapshots of:
  *   - the target config file (`snapshot`),
@@ -10,7 +10,7 @@
  * Each sibling is independently `null` when absent — the caller's
  * `createConfigObserveAuditRecord` projects the snapshot fields onto
  * the record's LKG-triple / backup-triple slots, nulling each when the
- * corresponding snapshot is null. Design §9.2 records reserve space
+ * corresponding snapshot is null. The audit records reserve space
  * for the backup writer even though no in-tree producer ships today
  * (the backup field set is a stable contract for the future writer).
  *
@@ -38,7 +38,7 @@ export interface ConfigFileObservation {
     readonly backup: FileSnapshot | null;
 }
 /**
- * Aggregate the design-§9.2 file-state observation for one config path.
+ * Aggregate the file-state observation for one config path.
  *
  * The `snapshot`, `lkg`, and `backup` fields are independently null
  * when the corresponding file is absent or unreadable. `exists`

package/node_modules/@comis/daemon/dist/config/read-config-file-observation.js

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
  * `readConfigFileObservation` — daemon-side aggregator that produces the
- * design-§9.2 file-state observation for one config path.
+ * file-state observation for one config path.
  *
  * Returns a `ConfigFileObservation` containing snapshots of:
  *   - the target config file (`snapshot`),
@@ -11,7 +11,7 @@
  * Each sibling is independently `null` when absent — the caller's
  * `createConfigObserveAuditRecord` projects the snapshot fields onto
  * the record's LKG-triple / backup-triple slots, nulling each when the
- * corresponding snapshot is null. Design §9.2 records reserve space
+ * corresponding snapshot is null. The audit records reserve space
  * for the backup writer even though no in-tree producer ships today
  * (the backup field set is a stable contract for the future writer).
  *
@@ -47,7 +47,7 @@ function backupPath(configPath) {
     return safePath(dir, `${base}${BACKUP_SUFFIX}`);
 }
 /**
- * Aggregate the design-§9.2 file-state observation for one config path.
+ * Aggregate the file-state observation for one config path.
  *
  * The `snapshot`, `lkg`, and `backup` fields are independently null
  * when the corresponding file is absent or unreadable. `exists`