comisai 1.0.45 → 1.0.46

package/node_modules/@comis/daemon/dist/wiring/setup-terminal-wake.js

@@ -1,40 +1,39 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * The daemon-side wake-FSM SUBSCRIBE wiring (124-09 Task 2, THE KEYSTONE; TR-07 /
- * SEC-11 / SEC-12 / OPS-08 / OPS-09) — modeled on `setup-background-completion-runner.ts`.
+ * The daemon-side wake-FSM subscribe wiring — modeled on `setup-background-completion-runner.ts`.
  *
- * `setupTerminalWake(deps)` makes the attention loop LIVE end-to-end:
- *   1. Constructs the recurring wake-FSM (`createTerminalWakeDispatcher`, 124-07) against
- *      a NARROW adapter bus that translates the daemon's re-published
- *      `terminal:input_needed` (124-09 Task 1) into the FSM's `TerminalInputNeededWake`
+ * `setupTerminalWake(deps)` makes the attention loop live end-to-end:
+ *   1. Constructs the recurring wake-FSM (`createTerminalWakeDispatcher`) against
+ *      a narrow adapter bus that translates the daemon's re-published
+ *      `terminal:input_needed` into the FSM's `TerminalInputNeededWake`
  *      (deriving the owner-scoped `owner` + a per-frame `requestId` the redaction-safe
  *      core event omits).
- *   2. Binds `isSessionActive` to the P4 owner-scoped registry (`registries.get(agentId)?
+ *   2. Binds `isSessionActive` to the owner-scoped registry (`registries.get(agentId)?
  *      .get(sessionId, owner) !== undefined`) — a wake for a killed/evicted/cross-owner
  *      session is dropped.
- *   3. Binds `wakeOneTurn` to the §4.4 woken-turn driver (`terminal-wake-turn.ts`):
+ *   3. Binds `wakeOneTurn` to the woken-turn driver (`terminal-wake-turn.ts`):
  *      status → read → decideAutoAnswer (safe-only) → send (audited) | escalate, with the
- *      loop-guard (SEC-11) escalating a re-rendered prompt.
+ *      loop-guard escalating a re-rendered prompt.
  *   4. Binds `escalate` (the FSM's hop-limit path) to a `terminal:escalated` emit + the
- *      NotifyFn chain (§4.7).
+ *      NotifyFn chain.
  *
- * **Owner derivation (the keystone seam).** The fd3 attention frame is unsolicited and the
+ * **Owner derivation (the central seam).** The fd3 attention frame is unsolicited and the
  * worker is owner-agnostic, so the re-published `terminal:input_needed` carries `agentId`
  * but neither `sessionKey` nor `requestId`. The wake `owner = { agentId, sessionKey }` is the
  * AGENT-TURN identity; the REGISTRY owner (status/read/send/active-check) is RECOVERED from the
- * session's STAMPED owner via `registry.getOwner` (ISSUE-3 — a channel/API drive is stamped
+ * session's STAMPED owner via `registry.getOwner` (a channel/API drive is stamped
  * under `(userId, sessionKey)`, which the re-publish drops), so a DETACHED drive's woken turns
  * resolve the LIVE session instead of dropping cross-owner. The `requestId` correlation key is
  * synthesized from `(sessionId, reason)` so N re-publishes of ONE unanswered frame coalesce
- * to ONE woken turn (OPS-09), and a distinct subsequent prompt (a fresh `reason`) is a fresh
+ * to ONE woken turn, and a distinct subsequent prompt (a fresh `reason`) is a fresh
  * wake.
  *
  * **One-per-daemon** (like the completion runner): subscribes the shared `TypedEventBus`
  * ONCE at startup; `shutdown()` unsubscribes + drains in-flight turns (reverse-order vs the
- * Task-1 emit hook, which is per-agent on the registry).
+ * emit hook, which is per-agent on the registry).
  *
  * Per AGENTS §2.4: composition root + factories. This wiring lives in `@comis/daemon`; the
- * FSM body (124-07) and the policy modules (124-04) live in `@comis/daemon` / `@comis/skills`.
+ * FSM body and the policy modules live in `@comis/daemon` / `@comis/skills`.
  *
  * @module
  */
@@ -53,10 +52,10 @@ import { emitTerminalOutcome, runHeartbeatTick, runBackstopSessionCheck, shouldF
 export function setupTerminalWake(deps) {
     const nowMs = deps.nowMs ?? systemNowMs;
     const log = deps.logger.child({ submodule: "setup-terminal-wake" });
-    // NOTIFY-01 (166-03): the resolved drive.notify policy (default "terminal" — today's intent).
+    // The resolved drive.notify policy (default "terminal").
     const notifyPolicy = deps.notifyPolicy ?? "terminal";
     // The structural notify/log/clock/policy bundle the extracted emit helper consumes
-    // (terminal-wake-notify.ts) — keeps the holder thin (the gating + the §2.7 record live there).
+    // (terminal-wake-notify.ts) — keeps the holder thin (the gating + the structured log record live there).
     const notifyDeps = {
         ...(deps.notify ? { notify: deps.notify } : {}),
         info: (obj, msg) => log.info(obj, msg),
@@ -69,124 +68,124 @@ export function setupTerminalWake(deps) {
     // a conservative daemon ceiling (the woken turn cannot widen them).
     const DEFAULT_MAX_HOPS = 8;
     const DEFAULT_MAX_CONCURRENT = 4;
-    // The shared loop-guard (SEC-11) — closure-local per-session ring, injected clock. One
+    // The shared loop-guard — closure-local per-session ring, injected clock. One
     // instance across woken turns so a re-rendered prompt is caught across frames.
     const loopGuard = createLoopGuard({ nowMs });
-    // DRIVE-02 (164-04): the closure-local promoted-session set — the daemon owns the
+    // The closure-local promoted-session set — the daemon owns the
     // promotion STATE (the skills wait tool only EMITS the content-free terminal:drive_promoted;
-    // it never reaches into daemon state — the layer-inversion the arch gate forbids). Mirrors
+    // it never reaches into daemon state — the layer inversion the arch gate forbids). Mirrors
     // the loopGuard lifecycle exactly: closure-local, reclaimed in onSessionGone (so a recycled
-    // sessionId never inherits a stale promotion), bounded over a milestone-length daemon. It is
+    // sessionId never inherits a stale promotion), bounded over a long-running daemon. It is
     // the promote-once dedupe: the skills tool emits per-qualifying-wait, this Set collapses
     // repeated emits for one session to ONE drive-started notify. A plain Set suffices (record
-    // + notify-once); 164-06 reads promotedSessions here (via driveScopeKey below) to flip the
+    // + notify-once); the drive-scope key below reads promotedSessions to flip the
     // drive-scope sessionKey for a promoted session's woken turns.
     const promotedSessions = new Set();
-    // DELIVER-01 (#2): the once-per-idle-stretch completion-notification latch. The backstop adds a
+    // The once-per-idle-stretch completion-notification latch. The backstop adds a
     // promoted session here when it FIRST observes it awaiting-input (finished its work + idle at the
     // prompt) and delivers the "drive finished — waiting for input" notification; the latch is cleared
     // when the drive resumes working, so a fresh idle after the user replies re-notifies. Reclaimed
     // on end-of-life alongside promotedSessions.
     const completionNotified = new Set();
-    // DRIVE-01 (164-06): the drive-scope attribution key for a session's woken turns. A
+    // The drive-scope attribution key for a session's woken turns. A
     // PROMOTED session routes to `drive:<sessionId>` (isolating its woken turns from the
-    // primary `sessionKey:""` conversation); an unpromoted session stays on `""` (today's
-    // inline path — byte-identical, I1). This is ONLY the FSM/journal/conversation attribution
+    // primary `sessionKey:""` conversation); an unpromoted session stays on `""` (the
+    // inline path — byte-identical). This is ONLY the FSM/journal/conversation attribution
     // key — `registryOwnerFor` strips it back to the stamped registry owner for every registry
-    // call (the I5 anchor), so the drive scope never changes which jail/allow-entry resolves.
+    // call, so the drive scope never changes which jail/allow-entry resolves.
     const driveScopeKey = (sessionId) => driveScopeKeyFor(sessionId, promotedSessions.has(sessionId));
-    // DRIVE-01 (164-06): the closure-local per-session journal holder — a PROMOTED drive's
+    // The closure-local per-session journal holder — a PROMOTED drive's
     // bounded content-free cross-wake memory. Mirrors the loopGuard lifecycle EXACTLY:
     // closure-local, keyed by the bare sessionId, reclaimed in onSessionGone (so a recycled
-    // sessionId never inherits a stale journal), bounded over a milestone-length daemon (the
+    // sessionId never inherits a stale journal), bounded over a long-running daemon (the
     // journal itself is per-session capped, terminal-drive-journal.ts). The journal SHAPE +
-    // pure (de)serialize/cap is the skills sibling (164-01); the daemon owns this holder. This
-    // is Phase 165 DUR-02's single durable-persistence point.
+    // pure (de)serialize/cap is the skills sibling; the daemon owns this holder. This
+    // is the single durable-persistence point.
     const driveJournals = new Map();
-    // MR-01 (DRIVE-01 / §7.1.6): the closure-local per-session drive-START timestamp — the
+    // The closure-local per-session drive-START timestamp — the
     // wall-clock ms a session was PROMOTED (the "drive started" moment, stamped in
     // onDrivePromoted). The woken-turn driver derives the journal's cumulative `elapsedMs` as
     // `now - driveStartedAtMs[sessionId]` (NOT a per-turn delta). Mirrors the driveJournals
     // lifecycle EXACTLY: closure-local, keyed by the bare sessionId, reclaimed in onSessionGone
-    // (so a recycled sessionId never inherits a stale start), bounded over a milestone-length
-    // daemon. Phase 165 DUR-02 persists it beside the journal so a resumed drive's elapsedMs
+    // (so a recycled sessionId never inherits a stale start), bounded over a long-running
+    // daemon. It is persisted beside the journal so a resumed drive's elapsedMs
     // survives a restart.
     const driveStartedAtMs = new Map();
-    // DUR-02 (165-07): the per-session owning agentId — the durable journal store is confined
+    // The per-session owning agentId — the durable journal store is confined
     // PER-AGENT (`<dataDir>/terminal-drive/<agentId>/journals`), but the journal holder + the
     // woken-turn driver key by the BARE sessionId (the worker is owner-agnostic). This map is
     // the bridge: stamped on promotion (onDrivePromoted) + on a re-attach
     // (terminal:drive_reattached), read by the journal.set persist wrapper so each journal
     // lands under its agent's confined dir. Mirrors the driveJournals lifecycle EXACTLY:
-    // closure-local, reclaimed in onSessionGone, bounded over a milestone-length daemon.
+    // closure-local, reclaimed in onSessionGone, bounded over a long-running daemon.
     const sessionAgent = new Map();
-    // LIVE-01 (165-07): the per-session wall-clock ms of the LAST wake/transition — the I2 gate
+    // The per-session wall-clock ms of the LAST wake/transition — the gate
     // the backstop reads. Stamped on EVERY inbound terminal:input_needed (a real fd3 wake AND
     // the backstop's own synthesized stuck — which makes the synth at-most-once per silent
     // stretch). The backstop fires its single liveness check ONLY when `now - lastTransitionMs
     // >= heartbeatMs` (i.e. ONLY in the absence of a wake), so a normally-progressing drive
-    // never triggers it. Reclaimed in onSessionGone; bounded over a milestone-length daemon.
+    // never triggers it. Reclaimed in onSessionGone; bounded over a long-running daemon.
     const lastTransitionMs = new Map();
-    // NOTIFY-02 (166-03): the per-session wall-clock ms of the LAST user-facing heartbeat sent —
+    // The per-session wall-clock ms of the LAST user-facing heartbeat sent —
     // the coarse-cadence dedupe stamp. The heartbeat tick fires for a promoted session only when
     // `now - lastHeartbeatSentMs >= heartbeatNotifyMs`, then stamps it. Mirrors lastTransitionMs's
     // lifecycle EXACTLY: closure-local, reclaimed in onSessionGone (a recycled sessionId starts
-    // unstamped → its first due-check fires from 0), bounded over a milestone-length daemon.
+    // unstamped → its first due-check fires from 0), bounded over a long-running daemon.
     const lastHeartbeatSentMs = new Map();
-    // BL-02 (165-REVIEW): the per-session "lazy-seed attempted this daemon life" marker. The
-    // registry's recover-on-boot emits terminal:drive_reattached during the FLOOR-01 sweep
+    // The per-session "lazy-seed attempted this daemon life" marker. The
+    // registry's recover-on-boot emits terminal:drive_reattached during the boot sweep
     // BEFORE this holder subscribes, so that event is DROPPED on the boot path — making the
     // resume non-load-bearing on the event. The robust fix is order-independent: on the FIRST
     // wake of a session whose in-memory journal is empty, the holder LAZY-LOADS the durable
     // journal (`maybeSeedRecoveredDrive`). This Set bounds that to ONE disk read per session
     // per life (a plain, never-recovered session pays one no-op load on its first wake, never
-    // again). Reclaimed in onSessionGone; bounded over a milestone-length daemon.
+    // again). Reclaimed in onSessionGone; bounded over a long-running daemon.
     const seedAttempted = new Set();
-    // The §4.4 woken-turn driver the FSM calls.
+    // The woken-turn driver the FSM calls.
     const wakeOneTurn = buildWokenTurnDriver({
         registries: deps.registries,
         getTerminalAttentionConfig: deps.getTerminalAttentionConfig,
         loopGuard,
         eventBus: deps.eventBus,
         ...(deps.notify ? { notify: deps.notify } : {}),
-        // DRIVE-01: a thin store wrapper over the closure-local Map (the driver engages it ONLY
-        // for a promoted, drive-scoped wake; an unpromoted turn touches nothing — I1).
+        // A thin store wrapper over the closure-local Map (the driver engages it ONLY
+        // for a promoted, drive-scoped wake; an unpromoted turn touches nothing).
         journal: {
             get: (sessionId) => driveJournals.get(sessionId),
             set: (sessionId, j) => {
                 driveJournals.set(sessionId, j);
-                // DUR-02 (165-07): the SINGLE durable persistence point — persist on EVERY set so a
-                // 40h drive's rolling journal survives a daemon restart. Gated on a present store +
+                // The SINGLE durable persistence point — persist on EVERY set so a
+                // multi-hour drive's rolling journal survives a daemon restart. Gated on a present store +
                 // a known owning agent (a promoted session always has one, stamped in onDrivePromoted
                 // / on re-attach). Best-effort: the store swallows any fs fault (the in-memory holder
-                // already updated — never blocks the woken turn). NEVER deletes (I10).
+                // already updated — never blocks the woken turn). NEVER deletes.
                 const agentId = sessionAgent.get(sessionId);
                 if (deps.driveJournalStore && agentId !== undefined) {
                     deps.driveJournalStore.persist(agentId, sessionId, j);
                 }
             },
         },
-        // MR-01: the drive-start accessor (the journal's elapsedMs base). Undefined until the
+        // The drive-start accessor (the journal's elapsedMs base). Undefined until the
         // session is promoted — the driver falls back to the turn's own start then (a sane ≥0
         // elapsedMs), so an unpromoted/pre-stamp turn never throws.
         driveStartMs: (sessionId) => driveStartedAtMs.get(sessionId),
-        maxCostUsd: deps.maxCostUsd, // ENDURE-01 (165-07): forward the operator spend ceiling to checkSpendCeiling.
+        maxCostUsd: deps.maxCostUsd, // forward the operator spend ceiling to checkSpendCeiling.
         nowMs,
         logger: deps.logger,
     });
-    // The owner-scoped active-check (the P4 registry). A wake for a session this reports
+    // The owner-scoped active-check. A wake for a session this reports
     // false (killed/evicted/cross-owner) is dropped + audited by the FSM.
     //
-    // DRIVE-01 (164-06): resolve via `registryOwnerFor(owner)` — the STAMPED registry owner.
+    // Resolve via `registryOwnerFor(owner)` — the STAMPED registry owner.
     // A promoted session's wake owner carries `drive:<id>`; passing that raw to `registry.get`
     // would mismatch the stamped owner (`sameOwner`), report the session inactive, and DROP
-    // its wakes — the I9-class silent strand (T-164-23). The strip resolves the live session,
+    // its wakes — a silent strand. The strip resolves the live session,
     // so a promoted drive's wakes are NOT dropped.
     const isSessionActive = (sessionId, owner) => {
         const registry = deps.registries.get(owner.agentId);
         if (!registry)
             return false;
-        // ISSUE-3: recover the STAMPED owner (getOwner) the worker→event re-publish drops, so a channel/API drive's live wake is not falsely dropped cross-owner; fall back to the owner-scoped get.
+        // Recover the STAMPED owner (getOwner) the worker→event re-publish drops, so a channel/API drive's live wake is not falsely dropped cross-owner; fall back to the owner-scoped get.
         return registry.getOwner?.(sessionId) !== undefined || registry.get(sessionId, registryOwnerFor(owner)) !== undefined;
     };
     // The hop-limit escalation (the FSM's forced-escalation path) → emit terminal:escalated
@@ -204,11 +203,11 @@ export function setupTerminalWake(deps) {
             });
         }
     };
-    // DRIVE-02 (164-04): consume the skills wait tool's content-free terminal:drive_promoted.
+    // Consume the skills wait tool's content-free terminal:drive_promoted.
     // The skills layer emits per-qualifying-wait; the daemon collapses to ONE "drive started
     // (backgrounded)" notify per session (promote-once via the promotedSessions Set). This is a
     // PROMOTION, not an escalation — it uses the WokenTurnNotify chain (origin:background_task),
-    // NOT escalate(). WR-03/T-164-12: defensively validate the structural fields the Set keys on
+    // NOT escalate(). Defensively validate the structural fields the Set keys on
     // (sessionId/agentId) and DROP a malformed payload with a WARN — never key state on garbage.
     const onDrivePromoted = (e) => {
         if (typeof e.sessionId !== "string" || typeof e.agentId !== "string") {
@@ -220,19 +219,19 @@ export function setupTerminalWake(deps) {
         if (promotedSessions.has(sessionId))
             return; // promote-once — the daemon dedupe.
         promotedSessions.add(sessionId);
-        // DUR-02 (165-07): stamp the owning agent so the journal.set persist wrapper can route
+        // Stamp the owning agent so the journal.set persist wrapper can route
         // this session's journal to the agent's confined durable dir (reclaimed in onSessionGone).
         sessionAgent.set(sessionId, agentId);
-        // LIVE-01 (165-07): the promotion instant IS a transition — seed lastTransitionMs so a
+        // The promotion instant IS a transition — seed lastTransitionMs so a
         // freshly-promoted, not-yet-woken drive is NOT immediately treated as silent-past-heartbeat
-        // (the backstop's first tick within heartbeatMs of promotion skips it, I2). A real wake
+        // (the backstop's first tick within heartbeatMs of promotion skips it). A real wake
         // re-stamps it on the next fd3 frame.
         lastTransitionMs.set(sessionId, nowMs());
-        // MR-01: stamp the drive-start at the promotion instant — the journal's cumulative
+        // Stamp the drive-start at the promotion instant — the journal's cumulative
         // elapsedMs measures from here. Stamped once (promote-once gate above), reclaimed in
         // onSessionGone, so a recycled sessionId re-stamps fresh.
         driveStartedAtMs.set(sessionId, nowMs());
-        // IN-01 (166-REVIEW): seed the heartbeat dedupe stamp at promotion (mirroring lastTransitionMs)
+        // Seed the heartbeat dedupe stamp at promotion (mirroring lastTransitionMs)
         // so the FIRST user heartbeat lands one full cadence AFTER promotion — not seconds after (an
         // unstamped session reads `last:0` ⇒ `now-0 >= cadence` fires on the first tick: "elapsed 0.0h").
         lastHeartbeatSentMs.set(sessionId, nowMs());
@@ -240,7 +239,7 @@ export function setupTerminalWake(deps) {
         if (deps.notify) {
             // Fire-and-forget on this synchronous bus listener; a notify fault must never become an
             // uncaughtException that crashes the daemon. The message is STRUCTURAL only (session id +
-            // "background") — no screen text/secrets (I3).
+            // "background") — no screen text/secrets.
             void deps
                 .notify({
                 agentId,
@@ -254,13 +253,13 @@ export function setupTerminalWake(deps) {
         }
     };
     deps.eventBus.on("terminal:drive_promoted", onDrivePromoted);
-    // DUR-02 / ME-02 (165-07 / 165-REVIEW): SEED a recovered durable drive into the holder's
+    // SEED a recovered durable drive into the holder's
     // in-memory state — the SHARED path for both the re-attach event (onDriveReattached) AND the
-    // BL-02 lazy-seed (maybeSeedRecoveredDrive). It (1) seeds the journal cache from the durable
+    // lazy-seed (maybeSeedRecoveredDrive). It (1) seeds the journal cache from the durable
     // store (resume from objective + answered prompts, not a fresh empty — so the next woken turn
-    // does not re-answer, I10), (2) PROMOTES the session (promotedSessions + sessionAgent) so the
-    // woken-turn driver sees it drive-scoped AND the LIVE-01 backstop + spend ceiling guard the
-    // resumed drive (ME-02 — they only key on promoted, which is empty for a boot-recovered drive
+    // does not re-answer), (2) PROMOTES the session (promotedSessions + sessionAgent) so the
+    // woken-turn driver sees it drive-scoped AND the backstop + spend ceiling guard the
+    // resumed drive (they only key on promoted, which is empty for a boot-recovered drive
     // otherwise), and (3) stamps driveStartedAtMs (the resumed elapsedMs survives the restart) +
     // lastTransitionMs (so a freshly-seeded drive is not instantly treated as silent-past-heartbeat).
     // A missing store / missing journal still PROMOTES + stamps (so the backstop guards even a
@@ -270,7 +269,7 @@ export function setupTerminalWake(deps) {
         const resumed = deps.driveJournalStore?.load(agentId, sessionId);
         if (resumed !== undefined)
             driveJournals.set(sessionId, resumed);
-        // ME-02: promote the recovered drive so the backstop + spend ceiling (which key ONLY on
+        // Promote the recovered drive so the backstop + spend ceiling (which key ONLY on
         // promotedSessions) guard its remaining, possibly-multi-hour life.
         promotedSessions.add(sessionId);
         // The resumed elapsedMs base: re-derive the drive-start from the journal's cumulative
@@ -279,15 +278,15 @@ export function setupTerminalWake(deps) {
         const elapsed = typeof resumed?.elapsedMs === "number" && Number.isFinite(resumed.elapsedMs) && resumed.elapsedMs >= 0 ? resumed.elapsedMs : 0;
         driveStartedAtMs.set(sessionId, nowMs() - elapsed);
         lastTransitionMs.set(sessionId, nowMs());
-        // IN-01 (166-REVIEW): seed the heartbeat dedupe stamp on resume too, so a recovered drive's
+        // Seed the heartbeat dedupe stamp on resume too, so a recovered drive's
         // first user heartbeat lands one full cadence after re-attach (not immediately on the next tick).
         lastHeartbeatSentMs.set(sessionId, nowMs());
         return resumed !== undefined;
     };
-    // DUR-02 (165-07): RESUME on a re-attach. The registry's recover-on-boot (165-06) re-attached
+    // RESUME on a re-attach. The registry's recover-on-boot re-attached
     // a surviving detached tmux session and emitted the content-free terminal:drive_reattached.
     // The holder consumes it to seed + promote the resumed drive (the shared seedRecoveredDrive).
-    // NOTE (BL-02): this event can fire DURING the FLOOR-01 boot sweep BEFORE this listener
+    // NOTE: this event can fire DURING the boot sweep BEFORE this listener
     // subscribes (daemon.ts), so on the boot path it is DROPPED — the lazy-seed (below) is the
     // load-bearing resume path; this listener covers a re-attach that happens AFTER subscription
     // (a future call order). Defensive: validate the structural ids before keying state.
@@ -302,7 +301,7 @@ export function setupTerminalWake(deps) {
         log.info({ sessionId, agentId, resumed, step: "drive_reattached" }, "terminal drive re-attached; journal resumed from durable store");
     };
     deps.eventBus.on("terminal:drive_reattached", onDriveReattached);
-    // BL-02 (165-REVIEW): LAZY-SEED a recovered durable drive on its FIRST wake when the boot
+    // LAZY-SEED a recovered durable drive on its FIRST wake when the boot
     // terminal:drive_reattached was dropped (the boot-race). On the first inbound wake for a
     // session whose in-memory journal is empty (and not yet seed-attempted this life), load the
     // durable journal: if one exists it is a recovered drive → seed + promote it (so the resume
@@ -319,8 +318,8 @@ export function setupTerminalWake(deps) {
         seedRecoveredDrive(sessionId, agentId);
         log.info({ sessionId, agentId, step: "drive_resume_lazy_seed" }, "terminal drive lazy-seeded a recovered journal on first wake (BL-02)");
     };
-    // LIVE-01 (165-07): stamp the per-session last-transition on EVERY inbound wake — the I2
-    // gate the backstop reads. BL-02: ALSO lazy-seed a recovered durable drive on its first wake
+    // Stamp the per-session last-transition on EVERY inbound wake — the
+    // gate the backstop reads. ALSO lazy-seed a recovered durable drive on its first wake
     // (the boot terminal:drive_reattached may have been dropped) — run FIRST so the wake adapter
     // computes a drive-scoped owner for a just-seeded session. A defensive structural-field check
     // (a malformed frame is dropped by the wake adapter anyway). This includes the backstop's OWN
@@ -334,18 +333,18 @@ export function setupTerminalWake(deps) {
         lastTransitionMs.set(e.sessionId, nowMs());
     };
     deps.eventBus.on("terminal:input_needed", onWakeTransition);
-    // LIVE-01 (165-07): the coarse liveness BACKSTOP timer — a safety net UNDER the event-driven
-    // wake (I2: it fires only in the ABSENCE of a wake + resolves to ONE check; NO per-tick
+    // The coarse liveness BACKSTOP timer — a safety net UNDER the event-driven
+    // wake (it fires only in the ABSENCE of a wake + resolves to ONE check; NO per-tick
     // screen read). Armed off the injected TimerPort exactly like the reaper
     // (setInterval(...).unref()), gated on BOTH timers + checkLiveness being present (absent ⇒
-    // no backstop, the pre-165 event-only behavior, I1). On each tick, for each PROMOTED session
+    // no backstop, event-only behavior). On each tick, for each PROMOTED session
     // (the backstop guards drives, not plain sessions): if a wake landed within heartbeatMs SKIP
-    // (a normally-progressing drive never triggers it, Pitfall 7); else run the SINGLE injected
+    // (a normally-progressing drive never triggers it); else run the SINGLE injected
     // checkLiveness (has-session + noProgressMs — NO screen) → busyOrHung:
-    //   - "busy" → NOT stuck (the ENDURE-01 reaper unify is the checkLiveness round-trip's
-    //     `registry.status` lastActivity stamp — LO-03; no separate refresh hook).
+    //   - "busy" → NOT stuck (the reaper liveness stamp is the checkLiveness round-trip's
+    //     `registry.status` lastActivity stamp; no separate refresh hook).
     //   - "hung" → synthesize a state:"stuck" wake through the EXISTING terminal:input_needed
-    //     seam (NOT a new event) + a §2.7 WARN; the stamp above makes this at-most-once per stretch.
+    //     seam (NOT a new event) + a WARN; the stamp above makes this at-most-once per stretch.
     let backstopHandle;
     // Process one promoted session's backstop check (async — the liveness check is a worker
     // round-trip). Separated from the loop so a per-session fault is isolated + awaited cleanly.
@@ -357,8 +356,8 @@ export function setupTerminalWake(deps) {
         const heartbeatMs = deps.heartbeatMs ?? 90_000;
         // Snapshot the promoted set (a synth-stuck-triggered woken turn could mutate it mid-tick). The
         // per-session body is the extracted runBackstopSessionCheck (terminal-wake-notify.ts) — this
-        // holder keeps ONLY the timer + the loop (800-line cap). It runs the I2 liveness probe (NO
-        // screen) and acts: hung → synth-stuck through the EXISTING input_needed seam; DELIVER-01 (#2)
+        // holder keeps ONLY the timer + the loop (file-size cap). It runs the liveness probe (NO
+        // screen) and acts: hung → synth-stuck through the EXISTING input_needed seam;
         // awaiting-input (finished + idle) → a ONE-TIME completion notification (de-duped via
         // completionNotified); still-working → clears the latch. Fire-and-forget per session.
         for (const sessionId of [...promotedSessions]) {
@@ -385,15 +384,15 @@ export function setupTerminalWake(deps) {
         // .unref() so a pending tick never holds the event loop open on SIGTERM (TimerHandle contract).
         backstopHandle.unref();
     }
-    // NOTIFY-02 (166-03): the COARSE user-facing heartbeat timer — a SECOND interval, distinct
-    // from the LIVE-01 backstop (a 1h user cadence vs the 90s internal liveness tick; the design
-    // names these "distinct"). Cloned from the backstop arm pattern (setInterval(...).unref()).
-    // Armed ONLY when timers + notify are present AND heartbeatNotifyMs > 0 (Pitfall 5 — `0` is
+    // The COARSE user-facing heartbeat timer — a SECOND interval, distinct
+    // from the backstop (a 1h user cadence vs the 90s internal liveness tick). Cloned from the
+    // backstop arm pattern (setInterval(...).unref()).
+    // Armed ONLY when timers + notify are present AND heartbeatNotifyMs > 0 (`0` is
     // terminal-only, never armed) AND notifyPolicy !== "none" (the heartbeat is a non-escalation
     // notification, suppressed under "none"; the escalation still fires via escalate()). The
     // per-tick loop body lives in the extracted terminal-wake-notify.ts (runHeartbeatTick) to keep
-    // this holder under the 800-line cap — it iterates promotedSessions ONLY (I1) + reads the
-    // journal (NEVER the screen, I2/I3).
+    // this holder under the file-size cap — it iterates promotedSessions ONLY + reads the
+    // journal (NEVER the screen).
     let heartbeatNotifyHandle;
     const heartbeatNotifyMs = deps.heartbeatNotifyMs ?? 3_600_000;
     if (deps.timers && deps.notify && heartbeatNotifyMs > 0 && notifyPolicy !== "none") {
@@ -423,51 +422,51 @@ export function setupTerminalWake(deps) {
         nowMs,
         logger: deps.logger,
     });
-    // WR-02 (+ IN-03/IN-04): reclaim ALL per-session attention state on end-of-life so
-    // a milestone-length daemon never leaks the loop-guard ring, the durable wake-state
-    // file, or the FSM in-memory state. Wired to the SAME eviction/exit signals the P4
+    // Reclaim ALL per-session attention state on end-of-life so
+    // a long-running daemon never leaks the loop-guard ring, the durable wake-state
+    // file, or the FSM in-memory state. Wired to the SAME eviction/exit signals the
     // reaper + the fd3 PTY-exit hook already publish (setup-terminal-tools.ts).
     //
-    // DUR-02 / I10 (165-07): the `durableJournal` disposition gates whether the DURABLE
+    // The `durableJournal` disposition gates whether the DURABLE
     // journal file is removed. The IN-MEMORY caches are ALWAYS reclaimed (no leak), but the
     // on-disk journal is removed ONLY on a CLEAN exit/evict (`"remove"`) and PRESERVED on a
     // crash/lost (`"preserve"`) so a genuinely-gone-but-recoverable durable drive keeps its
-    // journal for a fresh drive to resume (preserve-on-failure — the whole point of DUR-02).
+    // journal for a fresh drive to resume (preserve-on-failure).
     const onSessionGone = (sessionId, durableJournal) => {
         // Both total/never-throw.
         loopGuard.forget(sessionId);
         dispatcher.forgetSession(sessionId);
-        // DRIVE-02 (164-04): reclaim the promoted-state so a recycled sessionId never inherits a
+        // Reclaim the promoted-state so a recycled sessionId never inherits a
         // stale promotion (mirrors loopGuard.forget — wired to the SAME end-of-life signals below).
         promotedSessions.delete(sessionId);
-        completionNotified.delete(sessionId); // DELIVER-01 (#2): reclaim the completion latch (same lifecycle).
-        // DUR-02 (165-07): reclaim the DURABLE journal file FIRST (while the owning agent is still
-        // known) — but ONLY on a clean exit/evict. On a lost/crash it is PRESERVED (I10).
+        completionNotified.delete(sessionId); // reclaim the completion latch (same lifecycle).
+        // Reclaim the DURABLE journal file FIRST (while the owning agent is still
+        // known) — but ONLY on a clean exit/evict. On a lost/crash it is PRESERVED.
         const agentId = sessionAgent.get(sessionId);
         if (durableJournal === "remove" && deps.driveJournalStore && agentId !== undefined) {
             deps.driveJournalStore.remove(agentId, sessionId); // best-effort (the store swallows faults)
         }
-        // DUR-02 (165-07): reclaim the per-session owning-agent bridge (no leak; same lifecycle).
+        // Reclaim the per-session owning-agent bridge (no leak; same lifecycle).
         sessionAgent.delete(sessionId);
-        // DRIVE-01 (164-06): reclaim the per-session in-memory journal cache (no per-session memory
-        // leak over a milestone-length daemon; a recycled sessionId starts with a fresh journal).
-        // NOTE: this drops the in-memory copy only — the DURABLE file is governed above (I10).
+        // Reclaim the per-session in-memory journal cache (no per-session memory
+        // leak over a long-running daemon; a recycled sessionId starts with a fresh journal).
+        // NOTE: this drops the in-memory copy only — the DURABLE file is governed above.
         driveJournals.delete(sessionId);
-        // MR-01: reclaim the per-session drive-start timestamp alongside the journal (same
+        // Reclaim the per-session drive-start timestamp alongside the journal (same
         // lifecycle — no leak; a recycled sessionId re-stamps on its next promotion).
         driveStartedAtMs.delete(sessionId);
-        // LIVE-01 (165-07): reclaim the per-session last-transition stamp (same lifecycle — no
-        // leak; a recycled sessionId starts unstamped so its first wake re-arms the I2 gate).
+        // Reclaim the per-session last-transition stamp (same lifecycle — no
+        // leak; a recycled sessionId starts unstamped so its first wake re-arms the backstop gate).
         lastTransitionMs.delete(sessionId);
-        // NOTIFY-02 (166-03): reclaim the per-session heartbeat dedupe stamp (same lifecycle — no
+        // Reclaim the per-session heartbeat dedupe stamp (same lifecycle — no
         // leak; a recycled sessionId starts unstamped so its first due-check fires from 0).
         lastHeartbeatSentMs.delete(sessionId);
-        // BL-02 (165-REVIEW): reclaim the lazy-seed-attempted marker (same lifecycle — no leak; a
+        // Reclaim the lazy-seed-attempted marker (same lifecycle — no leak; a
         // recycled sessionId re-attempts the recovered-journal load on its first wake).
         seedAttempted.delete(sessionId);
         // removeWakeStateFile re-raises a non-ENOENT fs fault (@allow-throw) — wrap it so a
         // cleanup failure inside this bus listener can NEVER become an uncaughtException that
-        // crashes the daemon (IN-04). Surface the fault to the log with an actionable hint.
+        // crashes the daemon. Surface the fault to the log with an actionable hint.
         try {
             removeWakeStateFile(deps.dataDir, sessionId);
         }
@@ -475,11 +474,11 @@ export function setupTerminalWake(deps) {
             log.warn({ sessionId, err, hint: "could not remove wake-state file on session end-of-life; it will be dropped on the next boot's first wake", errorKind: "resource", step: "wake_cleanup_failed" }, "terminal wake-state cleanup failed");
         }
     };
-    // NOTIFY-01 (166-03): derive + emit the user-facing terminal outcome for a PROMOTED drive,
-    // CAPTURING wasPromoted + journal + drive-start BEFORE onSessionGone clears them (the Open-Q2
-    // ordering constraint). An UNPROMOTED session emits nothing (I1). The done/failed derivation +
-    // gating + §2.7 record live in the extracted sibling (terminal-wake-notify.ts). needs-you is
-    // NEVER routed here — the escalate() paths own it UNCONDITIONALLY (I4).
+    // Derive + emit the user-facing terminal outcome for a PROMOTED drive,
+    // CAPTURING wasPromoted + journal + drive-start BEFORE onSessionGone clears them (the
+    // ordering constraint). An UNPROMOTED session emits nothing. The done/failed derivation +
+    // gating + structured log record live in the extracted sibling (terminal-wake-notify.ts). needs-you is
+    // NEVER routed here — the escalate() paths own it UNCONDITIONALLY.
     const emitOutcomeBeforeGone = (sessionId, transition, capName, disposition, lostReason) => {
         const wasPromoted = promotedSessions.has(sessionId);
         const j = driveJournals.get(sessionId);
@@ -489,27 +488,27 @@ export function setupTerminalWake(deps) {
         // disposition is per the transition — exited/evicted "remove", lost "preserve", I10).
         onSessionGone(sessionId, disposition);
         if (!wasPromoted)
-            return; // an unpromoted (inline short) drive emits NO outcome (I1).
+            return; // an unpromoted (inline short) drive emits NO outcome.
         emitTerminalOutcome(notifyDeps, {
             sessionId,
             agentId,
             transition,
             ...(capName !== undefined ? { capName } : {}),
-            // WR-03: thread the genuine-death reason so the `failed` message + WARN name the actual cause.
+            // Thread the genuine-death reason so the `failed` message + WARN name the actual cause.
             ...(lostReason !== undefined ? { lostReason } : {}),
             durationMs: startedAt !== undefined ? nowMs() - startedAt : undefined,
             interactions: j?.interactions,
         });
     };
     // A reaper/operator eviction is a CLEAN end-of-life → remove the durable journal + name the cap
-    // on the `failed` outcome (events-terminal.ts:97-103). The eviction path is the SOLE owner of the
-    // cap-eviction outcome; CR-01 makes the reaper's companion plain lost inert (not a genuine death),
-    // so this no longer double-fires regardless of emit order (WR-01 resolved by CR-01).
+    // on the `failed` outcome (events-terminal.ts). The eviction path is the SOLE owner of the
+    // cap-eviction outcome; the reaper's companion plain lost is inert (not a genuine death),
+    // so this no longer double-fires regardless of emit order.
     const onEvicted = (e) => emitOutcomeBeforeGone(e.sessionId, "evicted", e.reason, "remove");
-    // CR-01 (Phase 166): map `lost` → `failed` ONLY for a GENUINE death (unrecoverable:true, from
-    // durable-wiring's onUnrecoverable — the pure `shouldFailOnLost` lives in the sibling, IN-02). A
+    // Map `lost` → `failed` ONLY for a GENUINE death (unrecoverable:true, from
+    // durable-wiring's onUnrecoverable — the pure `shouldFailOnLost` lives in the sibling). A
     // transient/recoverable lost (worker-crash respawn / reaper plain-lost / re-attaching durable
-    // drive) reclaims state only — NO `failed` (I9/I10). `exited` → done. WR-03: reason rides through.
+    // drive) reclaims state only — NO `failed`. `exited` → done. The reason rides through.
     const onStateChange = (e) => {
         if (e.state === "exited")
             emitOutcomeBeforeGone(e.sessionId, "exited", undefined, "remove");
@@ -527,17 +526,17 @@ export function setupTerminalWake(deps) {
         async shutdown() {
             deps.eventBus.off("terminal:session_evicted", onEvicted);
             deps.eventBus.off("terminal:session_state", onStateChange);
-            // DRIVE-02 (164-04): unsubscribe the promotion consumer (no leaked listener; a
+            // Unsubscribe the promotion consumer (no leaked listener; a
             // post-shutdown emit drives no notify).
             deps.eventBus.off("terminal:drive_promoted", onDrivePromoted);
-            // DUR-02 (165-07): unsubscribe the re-attach resume consumer too (no leaked listener).
+            // Unsubscribe the re-attach resume consumer too (no leaked listener).
             deps.eventBus.off("terminal:drive_reattached", onDriveReattached);
-            // LIVE-01 (165-07): unsubscribe the transition stamp + CANCEL the backstop interval (no
+            // Unsubscribe the transition stamp + CANCEL the backstop interval (no
             // leaked listener / timer; a post-shutdown tick never fires).
             deps.eventBus.off("terminal:input_needed", onWakeTransition);
             backstopHandle?.cancel();
             backstopHandle = undefined;
-            // NOTIFY-02 (166-03): CANCEL the user-facing heartbeat interval too (no leaked timer; a
+            // CANCEL the user-facing heartbeat interval too (no leaked timer; a
             // post-shutdown tick never fires).
             heartbeatNotifyHandle?.cancel();
             heartbeatNotifyHandle = undefined;
@@ -551,22 +550,21 @@ export function setupTerminalWake(deps) {
  * owner-scoped `owner` + a per-frame `requestId` synthesized from `(sessionId, reason)` (the
  * redaction-safe core event omits requestId; the FSM's `(sessionId,requestId)` dedupe
  * correlation needs it). N re-publishes of ONE unanswered frame share a `requestId` →
- * coalesce to ONE woken turn (OPS-09); a distinct subsequent prompt (a fresh `reason`) is a
+ * coalesce to ONE woken turn; a distinct subsequent prompt (a fresh `reason`) is a
  * fresh wake.
  *
- * DRIVE-01 (164-06): the woken-turn owner's `sessionKey` is derived via `driveScopeKey` — a
+ * The woken-turn owner's `sessionKey` is derived via `driveScopeKey` — a
  * PROMOTED session routes to `drive:<sessionId>` (isolating its woken turns from the primary
- * `sessionKey:""` conversation), an unpromoted one stays on `""` (the forcing-use-case
- * fallback, today's path). This is ONLY the FSM/journal/conversation attribution; the
+ * `sessionKey:""` conversation), an unpromoted one stays on `""` (the inline
+ * fallback). This is ONLY the FSM/journal/conversation attribution; the
  * woken-turn driver + the active-check strip it back to the stamped registry owner
- * (`registryOwnerFor`) so the drive scope never changes which jail/allow-entry resolves (I5).
+ * (`registryOwnerFor`) so the drive scope never changes which jail/allow-entry resolves.
  *
  * The translating handler is wrapped 1:1 so `off` removes exactly the wrapper `on` added —
  * a per-(handler) WeakMap pairs the FSM's handler with our wrapper (no module-global state).
  *
- * WR-03: this is the one inbound seam that previously trusted the bus payload's shape
- * blindly. Every other untrusted-boundary reader in this phase is defensively coded, so
- * this one VALIDATES the structural fields the FSM keys on (`sessionId`/`agentId`) BEFORE
+ * This is an inbound seam that must not trust the bus payload's shape
+ * blindly. It VALIDATES the structural fields the FSM keys on (`sessionId`/`agentId`) BEFORE
  * the cast and DROPS a malformed frame with a WARN — never keying FSM state on
  * `"undefined:undefined"` or masking a future-emit-site bug as a silently-dropped wake.
  */
@@ -576,7 +574,7 @@ function makeWakeAdapterBus(bus, log, driveScopeKey) {
         on(_event, handler) {
             const wrapped = (data) => {
                 const ev = data;
-                // WR-03: validate the shape before trusting it. A frame missing the structural
+                // Validate the shape before trusting it. A frame missing the structural
                 // correlation keys is dropped (defense-in-depth) — not forwarded with garbage.
                 if (typeof ev.sessionId !== "string" || typeof ev.agentId !== "string") {
                     log.warn({ hint: "malformed terminal:input_needed payload (missing sessionId/agentId); wake dropped", errorKind: "validation", step: "wake_adapter_dropped" }, "terminal wake adapter dropped a malformed frame");
@@ -588,9 +586,9 @@ function makeWakeAdapterBus(bus, log, driveScopeKey) {
                     // The redaction-safe core event omits requestId; correlate by (sessionId, reason)
                     // so duplicate re-publishes of one frame coalesce, a fresh prompt re-wakes.
                     requestId: `${ev.sessionId}:${reason}`,
-                    // DRIVE-01: drive:<id> for a promoted session (isolated woken-turn attribution), ""
+                    // drive:<id> for a promoted session (isolated woken-turn attribution), ""
                     // otherwise. This stays the AGENT-TURN id; the REGISTRY owner is RECOVERED downstream via
-                    // registry.getOwner (ISSUE-3, channel/API sessions), registryOwnerFor being the fallback.
+                    // registry.getOwner (channel/API sessions), registryOwnerFor being the fallback.
                     owner: { agentId: ev.agentId, sessionKey: driveScopeKey(ev.sessionId) },
                     state: ev.state === "stuck" ? "stuck" : "awaiting-input",
                     reason,

package/node_modules/@comis/daemon/dist/wiring/setup-tool-audit.d.ts

@@ -1,7 +1,7 @@
 /**
  * The `tool:executed` audit-log subscription (a skills concern) — extracted from
  * `setup-tools.ts` to keep that composition-root file under the 800-line architecture cap
- * (the established house extraction discipline, e.g. 124-06's `terminal-status-view.ts`).
+ * (the established house extraction discipline, e.g. `terminal-status-view.ts`).
  *
  * Subscribes the daemon event bus and emits a DEBUG audit line per tool execution: the
  * tool name + `durationMs` + success + the origin (userId/agentId/sessionKey) + a truncated,