comisai 1.0.45 → 1.0.46

package/node_modules/@comis/skills/dist/tools/builtin/terminal-driver/terminal-worker-launch.d.ts

@@ -1,14 +1,14 @@
 /**
- * terminal-worker-launch -- the production worker-launch posture (118-SPIKE-GO.md),
+ * terminal-worker-launch -- the production worker-launch posture,
  * extracted from `terminal-session-registry.ts` so that file stays under the 800-line
- * architecture cap (the gap-2 workspace wiring pushed it over).
+ * architecture cap.
  *
  * This is the `--permission` posture the daemon spawns the Terminal Worker under +
  * the production `spawnWorker` builder. It is PURE module-level wiring (no closure
  * over the registry's session map) — it depends only on `node:child_process` +
  * `systemEnvSnapshot` + the {@link FakeWorkerChild} structural type, so it lifts out
  * cleanly. The registry imports the builder back as the default `spawnWorker`; the
- * daemon (119-04) wires `buildProductionSpawnWorker(workerJsPath, dataDir)`.
+ * daemon wires `buildProductionSpawnWorker(workerJsPath, dataDir)`.
  *
  * INFRA-FREE (like the registry): imports ONLY `@comis/core` (`systemEnvSnapshot`) +
  * node builtins — never `@comis/infra`.
@@ -22,11 +22,11 @@ import type { FakeWorkerChild } from "./terminal-session-registry.js";
  * Computed from THIS module's own URL (both are siblings in the same
  * `terminal-driver` dist dir) so it is correct regardless of install location —
  * global npm prefix, bundled tarball, or dev dist — NEVER a data-dir placeholder.
- * The daemon's `resolveWorkerJsPath` delegates here (119-04 closure).
+ * The daemon's `resolveWorkerJsPath` delegates here.
  */
 export declare function resolveWorkerMainPath(): string;
 /**
- * The 118-proven worker-launch permission posture (the daemon spawns the worker
+ * The worker-launch permission posture (the daemon spawns the worker
  * under this via its existing `--allow-child-process`). node-pty `forkpty` was
  * proven to allocate a controlling pty under EXACTLY this posture on the VPS.
  * `--allow-fs-write` scopes are supplied by the production `spawnWorker` (the
@@ -35,8 +35,8 @@ export declare function resolveWorkerMainPath(): string;
 export declare const WORKER_PERMISSION_ARGS: readonly string[];
 /**
  * Build the production `spawnWorker` default: forks `node <permission-args>
- * <workerJsPath>` with a 4-fd stdio (fd3 is the events push channel per spec
- * §2.3), scoping fs-writes to the worker's durable-state dir + /tmp. The daemon
- * (119-04 wiring) constructs this with the resolved `workerJsPath` + `dataDir`.
+ * <workerJsPath>` with a 4-fd stdio (fd3 is the events push channel),
+ * scoping fs-writes to the worker's durable-state dir + /tmp. The daemon
+ * constructs this with the resolved `workerJsPath` + `dataDir`.
  */
 export declare function buildProductionSpawnWorker(workerJsPath: string, dataDir: string, tmuxSocketPath?: string): () => FakeWorkerChild;

package/node_modules/@comis/skills/dist/tools/builtin/terminal-driver/terminal-worker-launch.js

@@ -1,15 +1,15 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * terminal-worker-launch -- the production worker-launch posture (118-SPIKE-GO.md),
+ * terminal-worker-launch -- the production worker-launch posture,
  * extracted from `terminal-session-registry.ts` so that file stays under the 800-line
- * architecture cap (the gap-2 workspace wiring pushed it over).
+ * architecture cap.
  *
  * This is the `--permission` posture the daemon spawns the Terminal Worker under +
  * the production `spawnWorker` builder. It is PURE module-level wiring (no closure
  * over the registry's session map) — it depends only on `node:child_process` +
  * `systemEnvSnapshot` + the {@link FakeWorkerChild} structural type, so it lifts out
  * cleanly. The registry imports the builder back as the default `spawnWorker`; the
- * daemon (119-04) wires `buildProductionSpawnWorker(workerJsPath, dataDir)`.
+ * daemon wires `buildProductionSpawnWorker(workerJsPath, dataDir)`.
  *
  * INFRA-FREE (like the registry): imports ONLY `@comis/core` (`systemEnvSnapshot`) +
  * node builtins — never `@comis/infra`.
@@ -25,13 +25,13 @@ import { systemEnvSnapshot } from "@comis/core";
  * Computed from THIS module's own URL (both are siblings in the same
  * `terminal-driver` dist dir) so it is correct regardless of install location —
  * global npm prefix, bundled tarball, or dev dist — NEVER a data-dir placeholder.
- * The daemon's `resolveWorkerJsPath` delegates here (119-04 closure).
+ * The daemon's `resolveWorkerJsPath` delegates here.
  */
 export function resolveWorkerMainPath() {
     return fileURLToPath(new URL("./terminal-worker-main.js", import.meta.url));
 }
 /**
- * The 118-proven worker-launch permission posture (the daemon spawns the worker
+ * The worker-launch permission posture (the daemon spawns the worker
  * under this via its existing `--allow-child-process`). node-pty `forkpty` was
  * proven to allocate a controlling pty under EXACTLY this posture on the VPS.
  * `--allow-fs-write` scopes are supplied by the production `spawnWorker` (the
@@ -46,9 +46,9 @@ export const WORKER_PERMISSION_ARGS = [
 ];
 /**
  * Build the production `spawnWorker` default: forks `node <permission-args>
- * <workerJsPath>` with a 4-fd stdio (fd3 is the events push channel per spec
- * §2.3), scoping fs-writes to the worker's durable-state dir + /tmp. The daemon
- * (119-04 wiring) constructs this with the resolved `workerJsPath` + `dataDir`.
+ * <workerJsPath>` with a 4-fd stdio (fd3 is the events push channel),
+ * scoping fs-writes to the worker's durable-state dir + /tmp. The daemon
+ * constructs this with the resolved `workerJsPath` + `dataDir`.
  */
 export function buildProductionSpawnWorker(workerJsPath, dataDir, tmuxSocketPath) {
     const args = [
@@ -61,9 +61,9 @@ export function buildProductionSpawnWorker(workerJsPath, dataDir, tmuxSocketPath
         stdio: ["pipe", "pipe", "pipe", "pipe"],
         // Inject the data dir so the worker's durable-state dir matches the
         // `--allow-fs-write` scope above (the worker mkdir's + logs there).
-        // RECUR-03 (option A): inject this daemon generation's PER-BOOT tmux socket so the worker
+        // Inject this daemon generation's PER-BOOT tmux socket so the worker
         // creates NEW sessions on a fresh server in the live mount namespace (a restart's stranded
-        // prior-generation ns never breaks new bwrap sessions — RECUR-02). Stable across worker
+        // prior-generation ns never breaks new bwrap sessions). Stable across worker
         // respawns within a daemon generation (the daemon re-spawns with the same value); a restart
         // brings a new daemon → a new socket. Absent ⇒ the worker's legacy single-socket default.
         env: {

package/node_modules/@comis/skills/dist/tools/builtin/terminal-driver/terminal-worker-main.d.ts

@@ -1,13 +1,13 @@
 /**
  * terminal-worker-main — the standalone, daemon-supervised Terminal Worker
- * **process** (spec §1.1/§2.1: the crash-isolated child). The daemon forks this
+ * **process** (the crash-isolated child). The daemon forks this
  * under the proven `--permission` posture via `buildProductionSpawnWorker`
- * (terminal-worker-launch.ts). It is the SERVER half of the §2.3 IPC the registry
+ * (terminal-worker-launch.ts). It is the SERVER half of the IPC the registry
  * (client) talks to:
  *
  *   - request frames IN  on stdin  (fd0)  → decoded → `worker.handle`
  *   - reply frames   OUT on stdout (fd1)  ← `fs.writeSync(1, …)`
- *   - terminal:* event frames OUT on fd3  ← `fs.writeSync(3, …)` (no-poll attention, TR-11)
+ *   - terminal:* event frames OUT on fd3  ← `fs.writeSync(3, …)` (no-poll attention)
  *
  * It wires the production-default deps into `createTerminalWorker` (node-pty via
  * the guarded loader + pipe fallback, the @xterm emulator, the scope-jail
@@ -45,7 +45,7 @@ import type { TmuxBackendLike, PtyModuleLike } from "./terminal-worker-types.js"
 export declare function terminalWorkerDir(dataDir: string): string;
 export declare function durableDir(): string;
 /**
- * The explicit tmux `-S` socket path: `<durableDir>/tmux.sock`. DUR-01 survival key —
+ * The explicit tmux `-S` socket path: `<durableDir>/tmux.sock`. The durability survival key —
  * the socket lives on the PERSISTENT, shared data dir, NOT tmux's default
  * `/tmp/tmux-<uid>/default`. systemd `PrivateTmp=yes` gives every daemon START a fresh
  * private /tmp, so a /tmp socket is unreachable from the restarted daemon and re-attach
@@ -76,14 +76,14 @@ interface DurableWarnLogger {
     warn(obj: Record<string, unknown>, msg?: string): void;
 }
 /**
- * DUR-01 §7.1.5 — the durable-vs-fallback WARN. tmux availability is a RUNTIME property, NOT
- * a config-validation hard-require (the LOCKED decision): `drive.durable:true` parses fine and
+ * The durable-vs-fallback WARN. tmux availability is a RUNTIME property, NOT
+ * a config-validation hard-require: `drive.durable:true` parses fine and
  * DEGRADES gracefully when tmux is absent. When the worker boots on a host with no tmux
  * (`tmuxPath === undefined`), a later `backend:"tmux"` durable drive falls back to pty/pipe —
  * and a daemon restart then ends that session `lost` (with the journal preserved; the
- * user-facing `failed` OUTCOME is Phase-166 NOTIFY-01's). Log ONE content-free WARN at boot so
+ * user-facing `failed` outcome is derived downstream). Log ONE content-free WARN at boot so
  * an operator sees WHY a durable drive will not survive a restart on this host. Best-effort
- * (never throws out of the worker boot — a logging fault must not crash the process). §2.7:
+ * (never throws out of the worker boot — a logging fault must not crash the process). Logs
  * `errorKind:"precondition"` + `step:"tmux_resolve"` + a `hint` naming the degradation.
  *
  * @param tmuxPath - The resolved tmux binary path, or `undefined` when tmux is unavailable.
@@ -91,14 +91,14 @@ interface DurableWarnLogger {
  */
 export declare function warnIfDurableTmuxUnavailable(tmuxPath: string | undefined, logger: DurableWarnLogger): void;
 /**
- * The tmux long-run backend (OPS-05): a named tmux session outlives the worker, so a
- * milestone survives a worker crash + is re-attachable. `createTmuxBackend` makes the
+ * The tmux long-run backend: a named tmux session outlives the worker, so a
+ * long-running job survives a worker crash + is re-attachable. `createTmuxBackend` makes the
  * survival decision via `has-session`, runs the one-shot tmux commands (new-session /
  * set-option / kill-session) via `runOneShot` (`execFileSync`), and DRIVES the session via
  * a node-pty `tmux attach` (`spawnAttachPty` = `loadPty().spawn`) — which streams the pane,
  * forwards keystrokes, and exits on session death (the streaming model the worker's ring/
  * emulator needs; NOT the prior one-shot capture-pane that mis-flagged sessions exited).
- * Used for `backend:"tmux"` create AND the BL-01 recover-on-boot `reattach` (`forceAttachOnly`
+ * Used for `backend:"tmux"` create AND the recover-on-boot `reattach` (`forceAttachOnly`
  * — attach-or-gone, never a fresh `new-session`). `loadPty` is the SAME node-pty loader the
  * pty backend uses (the attach client is an ordinary pty).
  */

package/node_modules/@comis/skills/dist/tools/builtin/terminal-driver/terminal-worker-main.js

@@ -1,15 +1,15 @@
 // SPDX-License-Identifier: Apache-2.0
-// @allow-throw: the supervised worker PROCESS entry (spec §1.1/§2.1). A fatal wiring error MUST crash this child so the daemon's registry observes the `close` (sessions → lost → respawn) — never a silently half-spawned worker. The per-frame error boundary lives in createTerminalWorker.handle + the stdio pump.
+// @allow-throw: the supervised worker PROCESS entry. A fatal wiring error MUST crash this child so the daemon's registry observes the `close` (sessions → lost → respawn) — never a silently half-spawned worker. The per-frame error boundary lives in createTerminalWorker.handle + the stdio pump.
 /**
  * terminal-worker-main — the standalone, daemon-supervised Terminal Worker
- * **process** (spec §1.1/§2.1: the crash-isolated child). The daemon forks this
+ * **process** (the crash-isolated child). The daemon forks this
  * under the proven `--permission` posture via `buildProductionSpawnWorker`
- * (terminal-worker-launch.ts). It is the SERVER half of the §2.3 IPC the registry
+ * (terminal-worker-launch.ts). It is the SERVER half of the IPC the registry
  * (client) talks to:
  *
  *   - request frames IN  on stdin  (fd0)  → decoded → `worker.handle`
  *   - reply frames   OUT on stdout (fd1)  ← `fs.writeSync(1, …)`
- *   - terminal:* event frames OUT on fd3  ← `fs.writeSync(3, …)` (no-poll attention, TR-11)
+ *   - terminal:* event frames OUT on fd3  ← `fs.writeSync(3, …)` (no-poll attention)
  *
  * It wires the production-default deps into `createTerminalWorker` (node-pty via
  * the guarded loader + pipe fallback, the @xterm emulator, the scope-jail
@@ -61,7 +61,7 @@ export function durableDir() {
     return terminalWorkerDir(dataDir);
 }
 /**
- * The explicit tmux `-S` socket path: `<durableDir>/tmux.sock`. DUR-01 survival key —
+ * The explicit tmux `-S` socket path: `<durableDir>/tmux.sock`. The durability survival key —
  * the socket lives on the PERSISTENT, shared data dir, NOT tmux's default
  * `/tmp/tmux-<uid>/default`. systemd `PrivateTmp=yes` gives every daemon START a fresh
  * private /tmp, so a /tmp socket is unreachable from the restarted daemon and re-attach
@@ -116,14 +116,14 @@ export function resolveTmuxPath() {
     }
 }
 /**
- * DUR-01 §7.1.5 — the durable-vs-fallback WARN. tmux availability is a RUNTIME property, NOT
- * a config-validation hard-require (the LOCKED decision): `drive.durable:true` parses fine and
+ * The durable-vs-fallback WARN. tmux availability is a RUNTIME property, NOT
+ * a config-validation hard-require: `drive.durable:true` parses fine and
  * DEGRADES gracefully when tmux is absent. When the worker boots on a host with no tmux
  * (`tmuxPath === undefined`), a later `backend:"tmux"` durable drive falls back to pty/pipe —
  * and a daemon restart then ends that session `lost` (with the journal preserved; the
- * user-facing `failed` OUTCOME is Phase-166 NOTIFY-01's). Log ONE content-free WARN at boot so
+ * user-facing `failed` outcome is derived downstream). Log ONE content-free WARN at boot so
  * an operator sees WHY a durable drive will not survive a restart on this host. Best-effort
- * (never throws out of the worker boot — a logging fault must not crash the process). §2.7:
+ * (never throws out of the worker boot — a logging fault must not crash the process). Logs
  * `errorKind:"precondition"` + `step:"tmux_resolve"` + a `hint` naming the degradation.
  *
  * @param tmuxPath - The resolved tmux binary path, or `undefined` when tmux is unavailable.
@@ -136,7 +136,7 @@ export function warnIfDurableTmuxUnavailable(tmuxPath, logger) {
         logger.warn({
             errorKind: "precondition",
             step: "tmux_resolve",
-            hint: "durable requested but tmux unavailable; falling back non-durable; a restart then ends the session `lost` with the journal preserved (the user-facing `failed` outcome is derived in Phase 166)",
+            hint: "durable requested but tmux unavailable; falling back non-durable; a restart then ends the session `lost` with the journal preserved (the user-facing `failed` outcome is derived from the journal)",
         }, "terminal durable drive will degrade — tmux not found");
     }
     catch {
@@ -144,27 +144,27 @@ export function warnIfDurableTmuxUnavailable(tmuxPath, logger) {
     }
 }
 /**
- * The tmux long-run backend (OPS-05): a named tmux session outlives the worker, so a
- * milestone survives a worker crash + is re-attachable. `createTmuxBackend` makes the
+ * The tmux long-run backend: a named tmux session outlives the worker, so a
+ * long-running job survives a worker crash + is re-attachable. `createTmuxBackend` makes the
  * survival decision via `has-session`, runs the one-shot tmux commands (new-session /
  * set-option / kill-session) via `runOneShot` (`execFileSync`), and DRIVES the session via
  * a node-pty `tmux attach` (`spawnAttachPty` = `loadPty().spawn`) — which streams the pane,
  * forwards keystrokes, and exits on session death (the streaming model the worker's ring/
  * emulator needs; NOT the prior one-shot capture-pane that mis-flagged sessions exited).
- * Used for `backend:"tmux"` create AND the BL-01 recover-on-boot `reattach` (`forceAttachOnly`
+ * Used for `backend:"tmux"` create AND the recover-on-boot `reattach` (`forceAttachOnly`
  * — attach-or-gone, never a fresh `new-session`). `loadPty` is the SAME node-pty loader the
  * pty backend uses (the attach client is an ordinary pty).
  */
 export function buildLoadTmux(tmuxPath, loadPty) {
-    // DUR-01: the STABLE data-dir socket every tmux command targets via `-S` — so the server
+    // The STABLE data-dir socket every tmux command targets via `-S` — so the server
     // binds it and a restarted daemon re-attaches to the SAME socket (NOT the PrivateTmp-private
     // /tmp default, which the new daemon generation cannot reach).
-    // RECUR-03 (option A): NEW sessions are created on this daemon generation's PER-BOOT socket
+    // NEW sessions are created on this daemon generation's PER-BOOT socket
     // (the daemon injects COMIS_TERMINAL_TMUX_SOCKET = `<durableDir>/tmux-<gen>.sock`), so a restart's
     // new sessions get a fresh tmux server in the LIVE mount namespace — a stranded prior-generation
-    // ns never breaks new bwrap sessions (RECUR-02). A RE-ATTACH instead targets the SURVIVING
+    // ns never breaks new bwrap sessions. A RE-ATTACH instead targets the SURVIVING
     // session's OWN (prior-boot) socket, threaded per-frame from its descriptor (`a.tmuxSocket`). The
-    // legacy single socket is the fallback for both (no env / a pre-RECUR-03 descriptor).
+    // legacy single socket is the fallback for both (no env / an older descriptor without it).
     const legacySocket = resolveTmuxSocketPath(durableDir());
     // eslint-disable-next-line no-restricted-syntax -- worker PROCESS entry: the daemon threads the (non-secret) per-boot tmux socket via env when forking; not a SecretManager value.
     const bootSocket = process.env.COMIS_TERMINAL_TMUX_SOCKET ?? legacySocket;
@@ -208,10 +208,10 @@ export function buildLoadTmux(tmuxPath, loadPty) {
             runOneShot: runOneShot(a.env),
             spawnAttachPty: spawnAttachPtyOn(bootSocket, a),
         }),
-        // BL-01 (165-REVIEW): recover-on-boot re-attach — attach to an EXISTING session ONLY
+        // Recover-on-boot re-attach — attach to an EXISTING session ONLY
         // (forceAttachOnly). The driven command is NOT re-spawned (the surviving pane is attached),
         // so bin/argv are empty; a gone session returns undefined → the worker replies ok:false.
-        // RECUR-03: target the SURVIVOR's own per-boot socket (`a.tmuxSocket`), NOT this boot's.
+        // Target the SURVIVOR's own per-boot socket (`a.tmuxSocket`), NOT this boot's.
         reattach: (a) => {
             const socket = a.tmuxSocket ?? legacySocket;
             return createTmuxBackend({
@@ -246,13 +246,14 @@ function main() {
     // relays through (the daemon needn't coordinate — the proxy injects no secret).
     // Untouched for network none/full.
     const egressControl = createTerminalEgressProxy({ logger });
-    // Long-run tmux backend (OPS-05) — present only if tmux is installed; absent ⇒
+    // Long-run tmux backend — present only if tmux is installed; absent ⇒
     // a backend:"tmux" request degrades to pty/pipe (never an error).
     const tmuxPath = resolveTmuxPath();
     // The attach client is an ordinary pty → reuse the SAME node-pty loader the pty backend uses.
     const loadTmux = tmuxPath ? buildLoadTmux(tmuxPath, defaultLoadPty) : undefined;
-    // DUR-01 §7.1.5: WARN at boot if tmux is unavailable — a durable drive will degrade to
-    // non-durable here, so a restart ends it `lost` (journal preserved; `failed` is Phase-166's).
+    // WARN at boot if tmux is unavailable — a durable drive will degrade to
+    // non-durable here, so a restart ends it `lost` (journal preserved; the `failed`
+    // outcome is derived downstream).
     warnIfDurableTmuxUnavailable(tmuxPath, logger);
     const worker = createTerminalWorker({
         // The guarded node-pty loader (createRequire in a try → pipe fallback on a

package/node_modules/@comis/skills/dist/tools/builtin/terminal-driver/terminal-worker-reattach.d.ts

@@ -1,7 +1,6 @@
 /**
- * terminal-worker-reattach -- the worker's `reattach` frame handler (BL-01,
- * 165-REVIEW), extracted from `terminal-worker-entry.ts` so that file keeps headroom
- * under the 800-line architecture cap.
+ * terminal-worker-reattach -- the worker's `reattach` frame handler, extracted from
+ * `terminal-worker-entry.ts` so that file keeps headroom under the 800-line architecture cap.
  *
  * THE BUG IT FIXES (the recover-on-boot ZOMBIE). The registry rehydrates a recovered
  * durable session `running`, but the freshly-spawned worker has an EMPTY `sessions`
@@ -10,7 +9,7 @@
  * read. This handler is the missing seam: the `reattach` frame the registry sends for a
  * recovered session.
  *
- * THE CONTRACT (I10 — never double-drive). It attaches to an EXISTING detached tmux
+ * THE CONTRACT (never double-drive). It attaches to an EXISTING detached tmux
  * session BY NAME (`attachBackend({ attachOnly:true })` → `loadTmux.reattach`, which is
  * `has-session`-gated). A LIVE session is REGISTERED `running` and the handler replies
  * `ok:true` (the next `read` returns the live pane). A GONE session (reattach →
@@ -32,7 +31,7 @@ export interface ReattachWorkerArgs {
     /** The worker's closure-local per-session map (the re-attached session is registered here). */
     sessions: Map<string, SessionState>;
     /** The worker's @xterm emulator factory. `transformSnapshot` is the selected platform profile's
-     *  read-side render hook (RENDER-01) — passed through verbatim so a recovered durable session
+     *  read-side render hook — passed through verbatim so a recovered durable session
      *  keeps its ghost-strip after a daemon restart. */
     createEmulator: (opts: {
         cols: number;
@@ -44,7 +43,7 @@ export interface ReattachWorkerArgs {
     writeFd3?: (b: Buffer) => void;
     /** The worker's injected clock. */
     nowMs: () => number;
-    /** The operator stuck threshold (OPS-04). */
+    /** The operator stuck threshold. */
     stuckMs: number;
     /** The worker's structural logger. */
     logger: WorkerLogger;
@@ -62,7 +61,7 @@ export interface ReattachWorkerArgs {
     scrollbackDefault: number;
 }
 /**
- * Handle a `reattach` frame (BL-01). Returns `{ ok, backend }`; the entry maps `ok:false`
+ * Handle a `reattach` frame. Returns `{ ok, backend }`; the entry maps `ok:false`
  * straight onto the reply's `ok` channel (the registry flips `lost`). Total/never-throws
  * (the dispatch try/catch is the boundary, but this path has no throw site).
  */

package/node_modules/@comis/skills/dist/tools/builtin/terminal-driver/terminal-worker-reattach.js

@@ -1,8 +1,7 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * terminal-worker-reattach -- the worker's `reattach` frame handler (BL-01,
- * 165-REVIEW), extracted from `terminal-worker-entry.ts` so that file keeps headroom
- * under the 800-line architecture cap.
+ * terminal-worker-reattach -- the worker's `reattach` frame handler, extracted from
+ * `terminal-worker-entry.ts` so that file keeps headroom under the 800-line architecture cap.
  *
  * THE BUG IT FIXES (the recover-on-boot ZOMBIE). The registry rehydrates a recovered
  * durable session `running`, but the freshly-spawned worker has an EMPTY `sessions`
@@ -11,7 +10,7 @@
  * read. This handler is the missing seam: the `reattach` frame the registry sends for a
  * recovered session.
  *
- * THE CONTRACT (I10 — never double-drive). It attaches to an EXISTING detached tmux
+ * THE CONTRACT (never double-drive). It attaches to an EXISTING detached tmux
  * session BY NAME (`attachBackend({ attachOnly:true })` → `loadTmux.reattach`, which is
  * `has-session`-gated). A LIVE session is REGISTERED `running` and the handler replies
  * `ok:true` (the next `read` returns the live pane). A GONE session (reattach →
@@ -30,7 +29,7 @@ import { createAttentionEmitter } from "./terminal-attention-emitter.js";
 import { observeSettledFrame } from "./terminal-worker-classify.js";
 import { getPlatformProfile } from "./platforms/index.js";
 /**
- * Handle a `reattach` frame (BL-01). Returns `{ ok, backend }`; the entry maps `ok:false`
+ * Handle a `reattach` frame. Returns `{ ok, backend }`; the entry maps `ok:false`
  * straight onto the reply's `ok` channel (the registry flips `lost`). Total/never-throws
  * (the dispatch try/catch is the boundary, but this path has no throw site).
  */
@@ -40,13 +39,13 @@ export async function reattachWorkerSession(args) {
     const sessionId = String(p["sessionId"] ?? frame.sessionId);
     const cols = typeof p["cols"] === "number" ? p["cols"] : 80;
     const rows = typeof p["rows"] === "number" ? p["rows"] : 24;
-    // RECUR-03: the surviving session's OWN per-boot socket (the daemon threads it from the
+    // The surviving session's OWN per-boot socket (the daemon threads it from the
     // descriptor onto the reattach frame) — re-attach targets THAT server, not this boot's fresh one.
     const tmuxSocket = typeof p["tmuxSocket"] === "string" ? p["tmuxSocket"] : undefined;
-    // v2.26: the operator-declared allowId rides the reattach frame (threaded from the recovered
+    // The operator-declared allowId rides the reattach frame (threaded from the recovered
     // descriptor) so a recovered durable session RE-RESOLVES its platform profile — without this, a
-    // recovered claude drive reverts to the agnostic render/classify after a restart, reviving FINDING-3
-    // (the ghost-strip) and dropping perception. Selection is by allowId only (§5/INV-3).
+    // recovered claude drive reverts to the agnostic render/classify after a restart, reviving the
+    // ghost-strip and dropping perception. Selection is by allowId only.
     const allowId = typeof p["allowId"] === "string" ? p["allowId"] : undefined;
     const profile = allowId !== undefined ? getPlatformProfile(allowId) : undefined;
     const state = {

package/node_modules/@comis/skills/dist/tools/builtin/terminal-driver/terminal-worker-stdio-pump.d.ts

@@ -1,5 +1,5 @@
 /**
- * terminal-worker-stdio-pump — the SERVER half of the §2.3 worker IPC, extracted
+ * terminal-worker-stdio-pump — the SERVER half of the worker IPC, extracted
  * from `terminal-worker-main.ts` so it is unit-testable WITHOUT a fork (the
  * bootstrap just wires real process IO into it).
  *
@@ -34,7 +34,7 @@ export interface StdioPump {
  * `push` decodes synchronously (so a decoder throw is caught here, never
  * buffered toward a DoS) and fires `handle` asynchronously per frame; replies
  * are written in `handle`'s resolution order — the daemon correlates by
- * `requestId`, never arrival order (§2.3), so out-of-order replies are correct
+ * `requestId`, never arrival order, so out-of-order replies are correct
  * by construction.
  */
 export declare function createStdioPump(deps: StdioPumpDeps): StdioPump;

package/node_modules/@comis/skills/dist/tools/builtin/terminal-driver/terminal-worker-stdio-pump.js

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * terminal-worker-stdio-pump — the SERVER half of the §2.3 worker IPC, extracted
+ * terminal-worker-stdio-pump — the SERVER half of the worker IPC, extracted
  * from `terminal-worker-main.ts` so it is unit-testable WITHOUT a fork (the
  * bootstrap just wires real process IO into it).
  *
@@ -25,7 +25,7 @@ function errorMessage(err) {
  * `push` decodes synchronously (so a decoder throw is caught here, never
  * buffered toward a DoS) and fires `handle` asynchronously per frame; replies
  * are written in `handle`'s resolution order — the daemon correlates by
- * `requestId`, never arrival order (§2.3), so out-of-order replies are correct
+ * `requestId`, never arrival order, so out-of-order replies are correct
  * by construction.
  */
 export function createStdioPump(deps) {

package/node_modules/@comis/skills/dist/tools/builtin/terminal-driver/terminal-worker-supervisor.d.ts

@@ -1,24 +1,23 @@
 /**
- * terminal-worker-supervisor -- the registry's worker-supervision glue (the OPS-01
- * crash-isolation listeners + the 124-05 fd3 attention reader), extracted from
+ * terminal-worker-supervisor -- the registry's worker-supervision glue (the
+ * crash-isolation listeners + the fd3 attention reader), extracted from
  * `terminal-session-registry.ts` so that file keeps headroom under the 800-line cap.
  *
- * {@link wireWorkerSupervision} installs the three OPS-01 listeners (stdout/error/close)
- * AND, since 124-05 (TR-11), the no-poll fd3 events-push reader on `child.stdio?.[3]` —
+ * {@link wireWorkerSupervision} installs the three crash-isolation listeners
+ * (stdout/error/close) AND the no-poll fd3 events-push reader on `child.stdio?.[3]` —
  * decoding each `TerminalEventFrame` the worker pushes on a state transition and
  * dispatching it to the daemon-injected `onTerminalEvent` hook. The fd3 reader copies the
- * stdout HR-02 guard VERBATIM (a corrupt event frame WARNs + drops the worker, never
- * crashes the daemon — OPS-01). The three OPS-01 listeners are:
- *   - stdout `data`: the HR-02-guarded frame decoder (a malformed reply NEVER throws out of the
+ * stdout decode guard VERBATIM (a corrupt event frame WARNs + drops the worker, never
+ * crashes the daemon). The three listeners are:
+ *   - stdout `data`: the guarded frame decoder (a malformed reply NEVER throws out of the
  *     listener — a throw on a stream listener becomes an `uncaughtException` that takes the
  *     DAEMON down, the opposite of "a crash restarts the WORKER, never the daemon"). A
- *     `FrameTooLargeError` (HR-01 corrupt/hostile length prefix) is logged with a distinct
+ *     `FrameTooLargeError` (corrupt/hostile length prefix) is logged with a distinct
  *     `hint` from a JSON-parse failure; both WARN `errorKind:"validation"`, flip the worker's
  *     running sessions to `lost`, clear the handle (next `create` re-spawns), and NEVER rethrow.
  *     On success: `for (const f of frames) correlate(pending, f)`.
  *   - `error`: WARN `errorKind:"dependency"`, flip sessions `lost`, clear the handle.
  *   - `close`: INFO, flip running sessions to `exited(code)`, clear the handle.
- * Only the LOCATION of this block changed.
  *
  * INFRA-FREE (like the registry + every worker-side sibling): value-imports ONLY the
  * terminal-ipc framer + node builtins, and type-imports the registry's structural contracts
@@ -45,14 +44,14 @@ export interface WireWorkerSupervisionArgs {
     markRunningSessionsLost: () => void;
     /** Clear the worker handle + flush its pending waiters (the registry's closure-local helper); the next `ensureWorker` re-spawns. */
     clearWorker: () => void;
-    /** 124-05 (TR-11): the daemon-injected sink for each decoded fd3 {@link TerminalEventFrame} (the no-poll attention seam). Absent ⇒ the fd3 reader still decodes + guards, but drops events (no consumer). */
+    /** The daemon-injected sink for each decoded fd3 {@link TerminalEventFrame} (the no-poll attention seam). Absent ⇒ the fd3 reader still decodes + guards, but drops events (no consumer). */
     onTerminalEvent?: (frame: TerminalEventFrame) => void;
 }
 /**
- * Wire the OPS-01 crash-isolation listeners (stdout/error/close) + the 124-05 fd3
- * events-push reader onto a freshly-spawned worker child — see the module doc for the
- * per-listener contract. The fd3 reader (spec §2.3, TR-11) on `child.stdio?.[3]` decodes
- * the worker's attention/event frames with the SAME HR-02 guard the stdout reader has
+ * Wire the crash-isolation listeners (stdout/error/close) + the fd3 events-push
+ * reader onto a freshly-spawned worker child — see the module doc for the
+ * per-listener contract. The fd3 reader on `child.stdio?.[3]` decodes the worker's
+ * attention/event frames with the SAME decode guard the stdout reader has
  * (a corrupt event frame never crashes the daemon) and dispatches each to `onTerminalEvent`.
  */
 export declare function wireWorkerSupervision(args: WireWorkerSupervisionArgs): void;