comisai 1.0.45 → 1.0.46

package/node_modules/@comis/observability-otel/dist/traces.js

@@ -32,7 +32,7 @@ const CONTENT_BODY_KEYS = new Set(["content", "text", "parts", "message", "body"
 /**
  * Reduce a message list to a CONTENT-FREE structural summary: the role of each
  * message + the count. NEVER the `content` body. The summary is then routed
- * through `redactAttributes` (E3) so a planted secret in a stray non-content
+ * through `redactAttributes` so a planted secret in a stray non-content
  * field cannot survive, and serialised. Returns undefined when there is nothing
  * structural to emit.
  */
@@ -66,7 +66,7 @@ function systemInstructionSummary(value) {
  */
 export function emitTurnSpan(tracer, args) {
     const span = tracer.startSpan(`${args.operation} ${args.model}`);
-    // The Comis UUID as an attribute (NOT the OTel trace id — Pitfall 4).
+    // The Comis UUID as an attribute (NOT the OTel trace id).
     if (args.comisTraceId !== undefined) {
         span.setAttribute("comis.trace_id", args.comisTraceId);
     }
@@ -77,7 +77,7 @@ export function emitTurnSpan(tracer, args) {
     span.setAttribute("comis.duration_ms", args.durationMs);
     // The 3 content attrs — spec Opt-In; OMITTED unless captureContent. Even when
     // captured, Comis emits a CONTENT-FREE structural summary (roles + counts),
-    // never the raw body, re-redacted at the boundary (E3). A planted secret or a
+    // never the raw body, re-redacted at the boundary. A planted secret or a
     // message body cannot reach an attribute.
     if (args.captureContent === true) {
         const input = contentFreeMessageSummary(args.inputMessages);

package/node_modules/@comis/observability-otel/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/observability-otel",
   "private": true,
-  "version": "1.0.45",
+  "version": "1.0.46",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "OTLP + Prometheus telemetry export for Comis (opt-in extension)",

package/node_modules/@comis/orchestrator/dist/approval/index.d.ts

@@ -1,7 +1,7 @@
 /**
  * Orchestrator approval surface: the server-side InteractiveCallbackRouter
  * (parse → lookup → cross-session → expiry → verify → dispatch). Channels never
- * import this — they reach signing via the `@comis/core` primitive (Pitfall 5).
+ * import this — they reach signing via the `@comis/core` primitive.
  *
  * @module
  */

package/node_modules/@comis/orchestrator/dist/approval/index.js

@@ -2,7 +2,7 @@
 /**
  * Orchestrator approval surface: the server-side InteractiveCallbackRouter
  * (parse → lookup → cross-session → expiry → verify → dispatch). Channels never
- * import this — they reach signing via the `@comis/core` primitive (Pitfall 5).
+ * import this — they reach signing via the `@comis/core` primitive.
  *
  * @module
  */

package/node_modules/@comis/orchestrator/dist/approval/interactive-callback-router.d.ts

@@ -1,7 +1,7 @@
 /**
  * InteractiveCallbackRouter — the single server-side authority that parses,
  * looks-up-THEN-verifies, and dispatches every approval callback to
- * `ApprovalGate.resolveApproval()` (spec §6.4.4).
+ * `ApprovalGate.resolveApproval()`.
  *
  * Channels NEVER call `ApprovalGate` directly and NEVER carry `requestId`/`sessionKey`
  * on the wire — only `shortId`. The router resolves `shortId → requestId` server-side,
@@ -9,9 +9,9 @@
  * `ClockPort`, then constant-time-verifies the HMAC. `render()` delegates to the
  * `core/security` signing primitive so the renderers (which import `@comis/core`) and
  * the router share one signing implementation — no duplicated crypto, no
- * `channels → orchestrator` boundary violation (Pitfall 5).
+ * `channels → orchestrator` boundary violation.
  *
- * The route ORDER is load-bearing (Pitfall 2 — verify-before-lookup defeats
+ * The route ORDER is load-bearing (verify-before-lookup defeats
  * replay rejection): the pending-table lookup proves liveness, enables replay rejection,
  * and provides the server-side `requestId`/`sessionKey`/`expiresAt`. There is NO separate
  * replay store — `resolveApproval` removing the pending entry IS the replay guard (the
@@ -22,7 +22,7 @@
 import { type Result } from "@comis/shared";
 import type { ApprovalGate, ClockPort, CallbackRenderError } from "@comis/core";
 /**
- * Inbound approval callback (spec §6.4.4). `rawData` and `inboundUserId` are
+ * Inbound approval callback. `rawData` and `inboundUserId` are
  * attacker-controllable; `sessionKey` is orchestrator-derived from `channelKey`
  * BEFORE `route()` is called (trusted — never read from the wire).
  */
@@ -37,7 +37,7 @@ export type InboundCallback = {
     inboundUserId?: string;
 };
 /**
- * Closed result union (spec §6.4.4). `requestId` is returned only to the orchestrator
+ * Closed result union. `requestId` is returned only to the orchestrator
  * caller — never to the wire; channels receive only the resolution `kind`.
  */
 export type CallbackResolution = {
@@ -70,7 +70,7 @@ export interface InteractiveCallbackRouterDeps {
     readonly gate: ApprovalGate;
     /** Returns the HMAC signing secret (injected at the daemon composition root). */
     readonly getSecret: () => string;
-    /** Injected clock — expiry uses `clock.now()`, never a wall-clock global (Pitfall §). */
+    /** Injected clock — expiry uses `clock.now()`, never a wall-clock global. */
     readonly clock: ClockPort;
 }
 /**

package/node_modules/@comis/orchestrator/dist/approval/interactive-callback-router.js

@@ -2,7 +2,7 @@
 /**
  * InteractiveCallbackRouter — the single server-side authority that parses,
  * looks-up-THEN-verifies, and dispatches every approval callback to
- * `ApprovalGate.resolveApproval()` (spec §6.4.4).
+ * `ApprovalGate.resolveApproval()`.
  *
  * Channels NEVER call `ApprovalGate` directly and NEVER carry `requestId`/`sessionKey`
  * on the wire — only `shortId`. The router resolves `shortId → requestId` server-side,
@@ -10,9 +10,9 @@
  * `ClockPort`, then constant-time-verifies the HMAC. `render()` delegates to the
  * `core/security` signing primitive so the renderers (which import `@comis/core`) and
  * the router share one signing implementation — no duplicated crypto, no
- * `channels → orchestrator` boundary violation (Pitfall 5).
+ * `channels → orchestrator` boundary violation.
  *
- * The route ORDER is load-bearing (Pitfall 2 — verify-before-lookup defeats
+ * The route ORDER is load-bearing (verify-before-lookup defeats
  * replay rejection): the pending-table lookup proves liveness, enables replay rejection,
  * and provides the server-side `requestId`/`sessionKey`/`expiresAt`. There is NO separate
  * replay store — `resolveApproval` removing the pending entry IS the replay guard (the
@@ -24,14 +24,14 @@ import { ok } from "@comis/shared";
 import { parseCallbackData, verifyCallbackData, renderCallbackData, } from "@comis/core";
 /** Fallback approver identity when the channel did not supply an inbound user id. */
 const UNKNOWN_APPROVER = "chat:unknown";
-/** The plain-text verbs accepted on the §6.4.6 branch. */
+/** The plain-text verbs accepted on the plain-text reply branch. */
 const PLAINTEXT_VERBS = new Set(["approve", "deny", "details"]);
 /** A 12-char base62 shortId (case-SENSITIVE — base62 distinguishes case). */
 const SHORT_ID_RE = /^[0-9A-Za-z]{12}$/;
-/** Marker prefix for a signed callback attempt (spec §6.4.2 `v1.<choice>.<shortId>.<hmac>`). */
+/** Marker prefix for a signed callback attempt (`v1.<choice>.<shortId>.<hmac>`). */
 const SIGNED_PREFIX = "v1.";
 /**
- * Parse a plain-text reply (§6.4.6) into a verb + optional shortId suffix, or null.
+ * Parse a plain-text reply into a verb + optional shortId suffix, or null.
  *
  * Split-based (not a single regex) to avoid any ReDoS surface on attacker-controlled
  * `rawData` (`security/detect-unsafe-regex`): the verb is lower-cased for the
@@ -73,7 +73,7 @@ export function createInteractiveCallbackRouter(deps) {
         return { kind: "resolved", requestId, choice };
     }
     function routeSigned(inbound) {
-        // ORDER IS LOAD-BEARING (Pitfall 2). Do NOT reorder.
+        // ORDER IS LOAD-BEARING. Do NOT reorder.
         // 1. Strict parse of the signed wire format.
         const parsed = parseCallbackData(inbound.rawData);
         if (!parsed.ok)
@@ -99,7 +99,7 @@ export function createInteractiveCallbackRouter(deps) {
         return dispatch(choice, req.requestId, inbound.inboundUserId);
     }
     function routePlainText(inbound) {
-        // §6.4.6 — HMAC SKIPPED for this branch only (plain-text channels cannot carry a
+        // Plain-text branch — HMAC SKIPPED for this branch only (plain-text channels cannot carry a
         // signed payload); replay protection still from pending-table removal,
         // and sessionKey scoping still applies via pendingForSession.
         const command = parsePlainText(inbound.rawData);
@@ -126,7 +126,7 @@ export function createInteractiveCallbackRouter(deps) {
         // with `v1.` is a signed-callback attempt and routes through routeSigned, where a
         // strict-parse failure yields `malformed` (a corrupted/forged signed payload must
         // NOT silently fall through to the unauthenticated plain-text branch). Only input
-        // without the marker is treated as a plain-text reply (§6.4.6).
+        // without the marker is treated as a plain-text reply.
         const resolution = inbound.rawData.startsWith(SIGNED_PREFIX)
             ? routeSigned(inbound)
             : routePlainText(inbound);

package/node_modules/@comis/orchestrator/dist/channel-manager.js

@@ -202,14 +202,14 @@ export function createChannelManager(deps) {
                         }
                     });
                 });
-                // REACT-01: register the inbound-reaction fanout if the adapter exposes
+                // Register the inbound-reaction fanout if the adapter exposes
                 // it (Discord/Slack/Telegram). No-op adapters omit onReaction → the
                 // optional-call form registers nothing (honest no-op, NOT a gap).
                 adapter.onReaction?.((reaction) => {
-                    // WR-02: validate the binder-built reaction at the trust boundary (the
+                    // Validate the binder-built reaction at the trust boundary (the
                     // single fanout chokepoint all three platform binders converge on)
                     // through the domain `parseReaction` strictObject — it rejects an
-                    // empty/missing platform id or any smuggled field (V5) BEFORE the
+                    // empty/missing platform id or any smuggled field BEFORE the
                     // content-free event reaches the bus. A reaction is UNTRUSTED inbound;
                     // an invalid one is a fail-closed DROP (WARN, non-fatal), never an emit.
                     const parsed = parseReaction(reaction);
@@ -222,10 +222,10 @@ export function createChannelManager(deps) {
                         return;
                     }
                     // A reaction is NOT an inbound turn — do NOT mint a request context.
-                    // Emit the capture event (ids/emoji only); the daemon (Plan 04)
+                    // Emit the capture event (ids/emoji only); the daemon
                     // resolves the messageId→trajectory and observes the outcome. PLAIN
                     // emit (not ?.) so the architecture gate's regex + the type system
-                    // both see it (RESEARCH Pitfall 6).
+                    // both see it.
                     deps.eventBus.emit("channel:reaction_received", {
                         messageId: parsed.value.messageId,
                         reactorId: parsed.value.reactorId,

package/node_modules/@comis/orchestrator/dist/cross-session/announcement-batcher.d.ts

@@ -16,7 +16,7 @@ export interface QueuedAnnouncement {
     callerAgentId: string;
     callerSessionKey: string;
     runId: string;
-    /** Idempotency key `${callerSessionKey}::${runId}` (DELIVERY-01). Built once at the delivery entry; opaque here. Undefined for a top-level spawn (no callerSessionKey). */
+    /** Idempotency key `${callerSessionKey}::${runId}`. Built once at the delivery entry; opaque here. Undefined for a top-level spawn (no callerSessionKey). */
     idempotencyKey?: string;
 }
 export interface AnnouncementBatcherDeps {
@@ -39,7 +39,7 @@ export interface AnnouncementBatcherDeps {
             failedAt: number;
             attemptCount: number;
             lastError?: string;
-            /** Idempotency key `${callerSessionKey}::${runId}` (DELIVERY-01), carried onto the dead-letter entry. */
+            /** Idempotency key `${callerSessionKey}::${runId}`, carried onto the dead-letter entry. */
             idempotencyKey?: string;
         }): void;
     };
@@ -58,7 +58,7 @@ export interface AnnouncementBatcherDeps {
     /** Typed event bus for the counts/ids-only delivery_retried / delivery_deadlettered events (§2.7). */
     eventBus?: Pick<TypedEventBus, "emit">;
     /**
-     * Shared, BOUNDED delivered-key store (WR-02/WR-03). When injected by the
+     * Shared, BOUNDED delivered-key store. When injected by the
      * daemon wiring, the SAME instance is also handed to the no-batcher success
      * branches (`deliverAnnouncement`) and the failure path / DLQ recovery, so
      * every completion-delivery surface dedups against one set. Absent → the
@@ -71,9 +71,9 @@ export interface AnnouncementBatcher {
     flush(): Promise<void>;
     shutdown(): Promise<void>;
     readonly pending: number;
-    /** DELIVERY-01: has this idempotency key already been delivered (success-path dedup)? Shared with the failure path in Plan 03 (D-SHAREDDEDUP). */
+    /** Has this idempotency key already been delivered (success-path dedup)? Shared with the failure path. */
     hasDelivered(key: string): boolean;
-    /** DELIVERY-01: mark an idempotency key delivered. Caller marks ONLY after a successful send (never before the await) so a transient retry is preserved. */
+    /** Mark an idempotency key delivered. Caller marks ONLY after a successful send (never before the await) so a transient retry is preserved. */
     markDelivered(key: string): void;
 }
 /**

package/node_modules/@comis/orchestrator/dist/cross-session/announcement-batcher.js

@@ -93,15 +93,15 @@ export function createAnnouncementBatcher(deps) {
     const debounceMs = deps.debounceMs ?? DEFAULT_DEBOUNCE_MS;
     const queues = new Map();
     const timers = new Map();
-    // DELIVERY-01: idempotency keys whose delivery has SUCCEEDED. In-memory floor
+    // Idempotency keys whose delivery has SUCCEEDED. In-memory floor
     // (the documented at-least-once-across-restart boundary — the DLQ bounds
     // cross-restart re-delivery by runId/attemptCount/maxAgeMs). Marked ONLY on a
-    // successful send (Pitfall 3) so a transient failure can still be retried.
-    // WR-03: BOUNDED (FIFO) so it never leaks for the daemon lifetime — uses the
-    // injected shared dedup when present (WR-01/02: the no-batcher success
+    // successful send so a transient failure can still be retried.
+    // BOUNDED (FIFO) so it never leaks for the daemon lifetime — uses the
+    // injected shared dedup when present (the no-batcher success
     // branches + DLQ recovery mark the SAME set), else an internal bounded one.
     const deliveredKeys = deps.deliveryDedup ?? createDeliveryDedup();
-    /** DELIVERY-01: mark a delivered item's key (no-op for undefined-keyed / top-level spawns). Call ONLY after a successful send. */
+    /** Mark a delivered item's key (no-op for undefined-keyed / top-level spawns). Call ONLY after a successful send. */
     function markDeliveredIfKeyed(item) {
         if (item.idempotencyKey)
             deliveredKeys.mark(item.idempotencyKey);
@@ -115,13 +115,13 @@ export function createAnnouncementBatcher(deps) {
         });
     }
     /**
-     * DELIVERY-02: send `text` to the item's announce channel, self-healing
+     * Send `text` to the item's announce channel, self-healing
      * transient failures. Used per-item in BOTH the single-item and the
      * multi-item-batch fallback branches. Returns true on success (and marks the
      * key delivered), false on terminal failure (the caller enqueues the DLQ).
      *
-     * - No `classifyErrorContext` injected → legacy single-attempt: try once,
-     *   return false on throw (byte-identical to pre-DELIVERY-02).
+     * - No `classifyErrorContext` injected → single-attempt: try once,
+     *   return false on throw (no retry).
      * - Classified PERMANENT → emit delivery_deadlettered{transient:false,attempt:0},
      *   return false immediately (zero retries).
      * - Classified TRANSIENT → retry up to maxRetries with computeRetryBackoff
@@ -129,7 +129,7 @@ export function createAnnouncementBatcher(deps) {
      *   true; on exhaustion emit delivery_deadlettered{transient:true} + return false.
      *
      * `text` is the already-sanitized announcement (scrubbed by the caller before
-     * the first attempt) — retries reuse it; the scrub is never bypassed (T-171-07).
+     * the first attempt) — retries reuse it; the scrub is never bypassed.
      *
      * Returns `{ delivered, lastError }` — on terminal failure the caller enqueues
      * the DLQ and uses `lastError` for the entry's diagnostic field.
@@ -197,7 +197,7 @@ export function createAnnouncementBatcher(deps) {
         queues.delete(key);
         if (!queued || queued.length === 0)
             return;
-        // DELIVERY-01 dedup: drop items whose key is already delivered (handles a
+        // Idempotency dedup: drop items whose key is already delivered (handles a
         // rapid re-enqueue inside the same debounce window) AND collapse same-key
         // duplicates within this batch (keep the first). undefined-keyed items are
         // never deduped — every top-level-spawn delivery proceeds.
@@ -206,7 +206,7 @@ export function createAnnouncementBatcher(deps) {
         for (const item of queued) {
             const k = item.idempotencyKey;
             if (k !== undefined) {
-                if (deliveredKeys.has(k) || seen.has(k)) { // WR-03: bounded dedup lookup
+                if (deliveredKeys.has(k) || seen.has(k)) { // bounded dedup lookup
                     deps.logger?.debug({ runId: item.runId, hint: "duplicate delivery suppressed" }, "Announcement dedup no-op");
                     continue;
                 }
@@ -227,13 +227,13 @@ export function createAnnouncementBatcher(deps) {
                 // Single item -- deliver with original text unmodified
                 try {
                     await withTimeout(deps.announceToParent(first.callerAgentId, parsedKey, first.announcementText, first.announceChannelType, first.announceChannelId), ANNOUNCE_PARENT_TIMEOUT_MS, systemScheduleTimeout, "announceToParent");
-                    markDeliveredIfKeyed(first); // DELIVERY-01: mark on success only
+                    markDeliveredIfKeyed(first); // mark on success only
                     return;
                 }
                 catch (err) {
                     // Batch state fields in timeout WARN for diagnostics
                     deps.logger?.warn({ batchKey: key, err, batchSize: 1, itemsDelivered: 0, itemsRemaining: 1, isPartialDelivery: false, errorKind: "internal", hint: "Parent session injection failed/timed out; falling back to direct send" }, "Announcement single-item delivery failed");
-                    // DELIVERY-02: self-healing fallback — transient retries with backoff,
+                    // Self-healing fallback — transient retries with backoff,
                     // permanent dead-letters immediately. Scrub the text ONCE, reuse on retries.
                     const sanitizedText = sanitizeForUser(first.announcementText);
                     const { delivered, lastError } = await sendWithRetry(first, sanitizedText);
@@ -247,7 +247,7 @@ export function createAnnouncementBatcher(deps) {
                             failedAt: systemNowMs(),
                             attemptCount: 0,
                             ...(lastError ? { lastError } : {}),
-                            idempotencyKey: first.idempotencyKey, // DELIVERY-01
+                            idempotencyKey: first.idempotencyKey,
                         });
                     }
                     return;
@@ -266,19 +266,19 @@ export function createAnnouncementBatcher(deps) {
                 `Review these completed tasks and summarize the results for the user in your own voice. If no user notification is needed, respond with NO_REPLY.`;
             try {
                 await withTimeout(deps.announceToParent(first.callerAgentId, parsedKey, combinedText, first.announceChannelType, first.announceChannelId), ANNOUNCE_PARENT_TIMEOUT_MS, systemScheduleTimeout, "announceToParent");
-                // DELIVERY-01: the combined announce delivered all batch items at once.
+                // The combined announce delivered all batch items at once.
                 for (const item of items)
                     markDeliveredIfKeyed(item);
             }
             catch (err) {
                 deps.logger?.warn({ batchKey: key, batchSize: items.length, itemsDelivered: 0, itemsRemaining: items.length, isPartialDelivery: false, err, errorKind: "internal", hint: "Parent session injection failed/timed out; falling back to direct send" }, "Announcement batched delivery failed");
                 // Fallback: deliver each item individually via direct channel send.
-                // DELIVERY-02: each item self-heals through sendWithRetry (transient →
+                // Each item self-heals through sendWithRetry (transient →
                 // retry-with-backoff; permanent → immediate dead-letter) — the SAME
                 // retry/classify logic as the single-item branch, applied per item.
                 let fallbackDelivered = 0;
                 for (const item of items) {
-                    // Scrub ONCE per item, reuse on retries (T-171-07 — never bypass the scrub).
+                    // Scrub ONCE per item, reuse on retries (never bypass the scrub).
                     const sanitizedText = sanitizeForUser(item.announcementText);
                     const { delivered, lastError } = await sendWithRetry(item, sanitizedText);
                     if (delivered) {
@@ -295,7 +295,7 @@ export function createAnnouncementBatcher(deps) {
                             failedAt: systemNowMs(),
                             attemptCount: 0,
                             ...(lastError ? { lastError } : {}),
-                            idempotencyKey: item.idempotencyKey, // DELIVERY-01
+                            idempotencyKey: item.idempotencyKey,
                         });
                     }
                 }

package/node_modules/@comis/orchestrator/dist/cross-session/announcement-dead-letter.d.ts

@@ -23,14 +23,14 @@ export interface AnnouncementLogger {
     debug(obj: Record<string, unknown>, msg: string): void;
 }
 /**
- * Canonical 9-channel set covering production platform adapters. Used as the
+ * Canonical 10-channel set covering production platform adapters. Used as the
  * closed-union discriminator for sendToChannel(type, ...) instead of an open
  * `string`. Local definition (no @comis/core export currently aggregates the
  * platform-adapter channel types — the rest of the codebase carries this
  * set implicitly as adapter-specific channelType strings). "echo" is
  * included for development/testing parity with channels/echo-adapter.
  */
-export type ChannelType = "discord" | "telegram" | "slack" | "whatsapp" | "imessage" | "signal" | "irc" | "line" | "email" | "echo";
+export type ChannelType = "discord" | "telegram" | "slack" | "whatsapp" | "imessage" | "signal" | "irc" | "line" | "email" | "msteams" | "echo";
 /** A single dead-letter queue entry representing a failed announcement. */
 export interface DeadLetterEntry {
     id: string;
@@ -48,10 +48,10 @@ export interface DeadLetterEntry {
     lastError?: string;
     /** Thread ID for threaded delivery Persisted so retried deliveries land in the correct thread. */
     threadId?: string;
-    /** Idempotency key `${callerSessionKey}::${runId}` (DELIVERY-01). Optional/forward-additive — pre-existing JSONL rows have it undefined (no migration; parseEntries tolerates the missing field). */
+    /** Idempotency key `${callerSessionKey}::${runId}`. Optional/forward-additive — pre-existing JSONL rows have it undefined (no migration; parseEntries tolerates the missing field). */
     idempotencyKey?: string;
     /**
-     * HIGH-2 (ONCE-03/04) — the announce origin's `rootRunId`, half of the durable
+     * The announce origin's `rootRunId`, half of the durable
      * `(rootRunId, stepIndex)` ONCE-ledger idempotency key. Optional/forward-additive
      * (like {@link DeadLetterEntry.idempotencyKey}): pre-ledgering JSONL rows have it
      * undefined and `parseEntries` tolerates that — no migration. When present
@@ -60,7 +60,7 @@ export interface DeadLetterEntry {
      */
     rootRunId?: string;
     /**
-     * HIGH-2 (ONCE-03/04) — the stable per-announce `stepIndex` allocated ONCE at
+     * The stable per-announce `stepIndex` allocated ONCE at
      * first announce (`allocateOutwardStep`), the other half of the idempotency key.
      * Persisted so a retry after a restart re-uses the SAME key. Optional/forward-
      * additive (no migration).
@@ -78,7 +78,7 @@ export interface AnnouncementDeadLetterQueue {
      * Retry delivery of queued entries via the provided sendToChannel callback.
      * Processes entries sequentially, drops expired entries, uses atomic write.
      *
-     * WR-01: `onDelivered` (optional) is invoked with the entry's
+     * `onDelivered` (optional) is invoked with the entry's
      * `idempotencyKey` after a SUCCESSFUL re-delivery, so the caller can record
      * the recovered key in the shared deliveredKeys set (deliveryDedup.mark /
      * batcher.markDelivered). Without it, a DLQ-recovered announcement is never
@@ -108,12 +108,12 @@ interface AnnouncementDeadLetterQueueOptions {
     /** Optional logger for diagnostics. */
     logger?: AnnouncementLogger;
     /**
-     * HIGH-2 (ONCE-03/04) — the three-state outward-send ledger. When present,
+     * The three-state outward-send ledger. When present,
      * `drain` consults it BEFORE re-delivering an entry that carries a persisted
      * `(rootRunId, stepIndex)`: a committed row → SKIP the send (the announcement
      * already landed; the in-memory deliveredKeys set could not know this across a
-     * restart, the durable ledger does). `undefined` ⇒ the legacy at-least-once
-     * behavior (unchanged). Wired by Plan 12 (the sole daemon.ts editor).
+     * restart, the durable ledger does). `undefined` ⇒ the at-least-once
+     * behavior. Wired from the daemon.
      */
     outwardLedger?: OutwardSendLedgerPort;
 }

package/node_modules/@comis/orchestrator/dist/cross-session/announcement-dead-letter.js

@@ -155,14 +155,14 @@ export function createAnnouncementDeadLetterQueue(opts) {
                     // Skip if not yet eligible for retry
                     if (now - entry.lastAttemptAt < retryIntervalMs)
                         continue;
-                    // HIGH-2 (ONCE-03/04): before re-delivering, consult the durable ONCE
+                    // Before re-delivering, consult the durable ONCE
                     // ledger for an entry that carries its (rootRunId, stepIndex). A
                     // committed row means the announcement ALREADY landed — the in-memory
                     // deliveredKeys set rebuilds empty on restart and cannot know this, so
                     // without this check a restart would re-deliver a sent announcement (a
                     // double-notify). Skip the send, treat the entry as delivered. An
                     // old-format entry (no rootRunId/stepIndex) has no key to look up and
-                    // falls through to the legacy at-least-once path.
+                    // falls through to the at-least-once path.
                     if (outwardLedger && entry.rootRunId !== undefined && entry.stepIndex !== undefined) {
                         const row = await outwardLedger.lookup(entry.rootRunId, entry.stepIndex);
                         if (row.ok && row.value?.state === "committed") {
@@ -184,7 +184,7 @@ export function createAnnouncementDeadLetterQueue(opts) {
                         const success = await sendToChannel(entry.channelType, entry.channelId, entry.announcementText, entry.threadId ? { threadId: entry.threadId } : undefined);
                         if (success) {
                             delivered.add(entry.id);
-                            // WR-01: record the recovered key as delivered so a later sweep
+                            // Record the recovered key as delivered so a later sweep
                             // (deliverFailureNotification) does not double-notify the same
                             // run. Fired ONLY on success and ONLY for keyed entries.
                             if (entry.idempotencyKey)

package/node_modules/@comis/orchestrator/dist/cross-session/cross-session-sender.d.ts

@@ -28,25 +28,25 @@ export interface CrossSessionSenderDeps {
     eventBus: TypedEventBus;
     config: AgentToAgentConfig;
     /**
-     * HIGH-2 (ONCE-01/02) — the three-state outward-send ledger. When present
+     * The three-state outward-send ledger. When present
      * (alongside {@link CrossSessionSenderDeps.durableRuns} + a resolvable
      * rootRunId), the completion-announcement send is routed through the SAME
      * exactly-once ledger as `message.send`, so a restart-driven re-announce of an
      * already-committed announcement is a no-op (no double-notify). `undefined` on
-     * a non-autonomy daemon ⇒ the announce is a pass-through (unchanged behavior).
-     * Wired by Plan 12 (the sole daemon.ts editor for this injection).
+     * a non-autonomy daemon ⇒ the announce is a pass-through.
+     * Wired from the daemon.
      */
     outwardLedger?: OutwardSendLedgerPort;
     /**
-     * HIGH-2 — allocates the stable per-announce `stepIndex` (the other half of the
+     * Allocates the stable per-announce `stepIndex` (the other half of the
      * `(rootRunId, stepIndex)` idempotency key) ONCE via `allocateOutwardStep`.
-     * `undefined` ⇒ pass-through. Wired by Plan 12.
+     * `undefined` ⇒ pass-through. Wired from the daemon.
      */
     durableRuns?: DurableRunPort;
     /**
-     * HIGH-2 — resolves the announce origin's `rootRunId` from the (parsed) caller
+     * Resolves the announce origin's `rootRunId` from the (parsed) caller
      * session key, the SAME resolver the message handlers use. `undefined` (or an
-     * unresolvable key) ⇒ pass-through. Wired by Plan 12.
+     * unresolvable key) ⇒ pass-through. Wired from the daemon.
      */
     resolveRootRunId?: (sessionKey: SessionKey) => string;
 }

package/node_modules/@comis/orchestrator/dist/cross-session/cross-session-sender.js

@@ -31,28 +31,28 @@ export function createCrossSessionSender(deps) {
     }
     /**
      * Send the completion announcement through the SAME three-state ONCE ledger as
-     * `message.send` (HIGH-2). The lifecycle written around the single
-     * `deps.sendToChannel` call mirrors `wrapOutwardSend` (Plan 05) exactly:
+     * `message.send`. The lifecycle written around the single
+     * `deps.sendToChannel` call mirrors `wrapOutwardSend` exactly:
      *   lookup (committed → no-op) → begin (send_attempt_started, the SOLE INSERT)
      *   → markUnknown (unknown_after_send) → sendToChannel → commit.
      * A committed `(rootRunId, stepIndex)` short-circuits to a no-op (the announce
      * already landed across a restart — no double-notify). A begin UNIQUE-collision
      * is "already in flight" (NO second send). A permanent failure → markFailed
-     * (no retry, ONCE-04); a transient failure leaves the row `unknown_after_send`
-     * for the Plan-04 recovery scan. Content-free (T-216-03): only a sha256 digest
+     * (no retry); a transient failure leaves the row `unknown_after_send`
+     * for the recovery scan. Content-free: only a sha256 digest
      * reaches the ledger, never the announcement body. The agentId for the row is
      * the caller's resolved agent (the announce origin).
      */
     async function ledgeredAnnounce(ledger, rootRunId, stepIndex, agentId, channelType, channelId, text) {
-        // ONCE-02 dedup read: a committed row short-circuits a replay to a no-op —
+        // Dedup read: a committed row short-circuits a replay to a no-op —
         // deps.sendToChannel is never reached (no restart double-notify).
         const existing = await ledger.lookup(rootRunId, stepIndex);
         if (existing.ok && existing.value?.state === "committed") {
             return true; // the announcement already landed
         }
-        // Content-free key (T-216-03): only the sha256 slice — never the body.
+        // Content-free key: only the sha256 slice — never the body.
         const contentDigest = createHash("sha256").update(text).digest("hex").slice(0, 16);
-        // ONCE-01: send_attempt_started BEFORE the platform call. A UNIQUE
+        // send_attempt_started BEFORE the platform call. A UNIQUE
         // (rootRunId, stepIndex) collision means another attempt owns this send →
         // do NOT issue a second platform call (no double-notify).
         const begun = await ledger.begin({ rootRunId, stepIndex, agentId, channelType, channelId, contentDigest });
@@ -76,9 +76,9 @@ export function createCrossSessionSender(deps) {
             await ledger.commit(rootRunId, stepIndex, "delivered");
             return true;
         }
-        // A permanent failure is terminal (ONCE-04): markFailed, skip retry. A
+        // A permanent failure is terminal: markFailed, skip retry. A
         // transient failure (or a false return) leaves the row unknown_after_send for
-        // the Plan-04 recovery scan — never a blind replay.
+        // the recovery scan — never a blind replay.
         if (sendErr && isPermanentError(sendErr.message)) {
             await ledger.markFailed(rootRunId, stepIndex, "permanent");
         }
@@ -87,7 +87,7 @@ export function createCrossSessionSender(deps) {
     async function announce(channelType, channelId, text, callerSessionKey) {
         if (!channelType || !channelId)
             return false;
-        // HIGH-2: route the announce through the ONCE ledger when the ledger +
+        // Route the announce through the ONCE ledger when the ledger +
         // durableRuns deps are wired AND the caller resolves to a rootRunId. Allocate
         // the stepIndex ONCE for this announce (the stable key across a restart).
         const rootRunId = resolveAnnounceRootRunId(callerSessionKey);

package/node_modules/@comis/orchestrator/dist/execution/activity-circuit-breaker.d.ts

@@ -1,12 +1,12 @@
 /**
- * ActivityCircuitBreaker — auto-managed per-agent×channel breaker
- * (spec §17.7). A permission storm against a forbidden channel API must
+ * ActivityCircuitBreaker — auto-managed per-agent×channel breaker.
+ * A permission storm against a forbidden channel API must
  * auto-quiesce without operator intervention while staying visible to ops.
  *
  * Two independent failure modes, classified on the `ActivityRenderError.kind`
  * union produced by `renderer.apply()` (`channel-activity-renderer.ts:85-90`) —
  * NOT the log error-kind union, which has no `permission`/transient-network
- * member (Pitfall 5):
+ * member:
  *   • `permission`                        → 3 consecutive → STICKY trip. The
  *     clock-based half-open NEVER applies; only `reset(key)` (the config-reload
  *     path) clears it.

package/node_modules/@comis/orchestrator/dist/execution/activity-circuit-breaker.js

@@ -2,7 +2,7 @@
 const DEFAULT_PERMISSION_THRESHOLD = 3;
 /** Default consecutive `internal`|`transient_network` count that trips a half-open breaker. */
 const DEFAULT_TRANSIENT_THRESHOLD = 5;
-/** Default half-open probe delay for a transient trip — 5 minutes (spec §17.7). */
+/** Default half-open probe delay for a transient trip — 5 minutes. */
 const DEFAULT_HALF_OPEN_MS = 300_000;
 function classify(e) {
     switch (e.kind) {