comisai 1.0.45 → 1.0.46

package/node_modules/@comis/agent/dist/safety/tool-retry-breaker.js

@@ -2,17 +2,15 @@
 /**
  * Tool retry circuit breaker: per-tool-signature consecutive failure tracking.
  *
- * Prevents infinite retry loops (the original repro: 48-call MCP-server retry incident) by blocking
- * tool calls after repeated failures and providing actionable LLM guidance with
- * alternative tool suggestions.
+ * Prevents infinite retry loops (e.g. an agent re-calling a failing MCP server
+ * tool dozens of times) by blocking tool calls after repeated failures and
+ * providing actionable LLM guidance with alternative tool suggestions.
  *
  * Two-level tracking:
  * - **Signature-level** (tool + sorted-args fingerprint): blocks after N consecutive
  *   failures for the exact same tool+args combination.
  * - **Tool-level** (tool name only): blocks after M total failures across all args
  *   for the same tool name.
- *
-
  *
  * @module
  */
@@ -37,10 +35,10 @@ export function extractErrorTag(errorText) {
     //    Every exec failure starts with that envelope, so without unwrapping
     //    the 80-char fallback below buckets structurally-identical-envelope
     //    errors under the same tag (`content_type_text_text_...`) even when
-    //    the inner stderr is completely different. That's what collapsed
-    //    exec in session 678314278 lines 40-51 — two `spawn sandbox-exec
-    //    ENOENT` failures triggered maxConsecutiveErrorPatterns, which then
-    //    also rejected an unrelated `python3 --version` probe. Unwrap up to
+    //    the inner stderr is completely different — e.g. two `spawn
+    //    sandbox-exec ENOENT` failures trip maxConsecutiveErrorPatterns and
+    //    the shared envelope tag then also rejects an unrelated
+    //    `python3 --version` probe, collapsing exec entirely. Unwrap up to
     //    2 levels deep (the breaker's own block message is a *second*
     //    envelope layer wrapping the inner tool failure).
     let unwrapped = errorText;
@@ -114,10 +112,9 @@ function peelEnvelope(text) {
  * not tool-execution failures. These are corrective feedback — the agent
  * can fix them by changing its args on the next call — so they MUST NOT
  * count toward the breaker's signature, tool-total, or error-pattern
- * counters. Counting them collapsed exec entirely during a legitimate
- * Cloudflare Pages deploy attempt when the agent iterated through several
- * command shapes looking for one that cleared the shell-substitution +
- * env-allowlist guards (Telegram session 678314278, jsonl lines 86–105).
+ * counters. Counting them collapses exec entirely during legitimate work —
+ * e.g. an agent iterating through several command shapes looking for one
+ * that clears the shell-substitution + env-allowlist guards.
  *
  * Real tool-execution failures (`permission_denied`, `not_found`,
  * `conflict`, `timeout`, EPERM sandbox denies, etc.) are unchanged —
@@ -148,11 +145,10 @@ export function isParameterValidationTag(tag) {
  * exit 1), NOT evidence that the `exec`/`process` tool is unavailable. The
  * agent fixes its input and re-runs, so — exactly like PARAMETER_VALIDATION_TAGS
  * — these MUST NOT count toward the breaker's signature, tool-total, or
- * error-pattern thresholds. Counting them shut exec down mid-task in Telegram
- * session 678314278 (daemon.1.log, 2026-06-06 20:27): repeated `npm run build`
- * exits of 2 tripped maxConsecutiveErrorPatterns and the breaker told the model
- * exec was "unavailable. DO NOT retry this tool", killing the edit→build→fix
- * loop and forcing a bluffed completion.
+ * error-pattern thresholds. Counting them shuts exec down mid-task: repeated
+ * `npm run build` exits of 2 trip maxConsecutiveErrorPatterns and the breaker
+ * tells the model exec is "unavailable. DO NOT retry this tool", killing the
+ * edit→build→fix loop and forcing a bluffed completion.
  *
  * The discriminator is deliberately `details.exitCode` — the SAME field the
  * pi-event bridge inspects to flip toolSuccess=false in the first place
@@ -250,7 +246,7 @@ function buildSandboxRedirectMessage(errorText) {
  * @param errorTag - Normalized error tag extracted from lastError (used to branch on validation errors)
  * @param isToolLevel - Whether this is a tool-level (total) or signature-level (consecutive) block
  *
- * Exported as a test seam for R10b — the recordResult accumulation path is
+ * Exported as a test seam — the recordResult accumulation path is
  * unreachable for parameter-validation tags (early-return on
  * `PARAMETER_VALIDATION_TAGS.has(errorTag)` in `recordResult`),
  * so tests call this function directly.
@@ -400,7 +396,7 @@ export function createToolRetryBreaker(config) {
                 // never clears blockedTools. So a tool that has already crossed
                 // maxToolFailures stays hard-blocked even after this success — emitting
                 // `reset` here would assert the breaker is usable again while
-                // beforeToolCall still returns block:true (WR-151-03). Gate the reset
+                // beforeToolCall still returns block:true. Gate the reset
                 // transition on the tool's actual availability: only report reset when
                 // the success genuinely restores a usable tool (signature-level recovery
                 // on a tool that is NOT tool-level blocked). The local counter cleanup
@@ -441,8 +437,8 @@ export function createToolRetryBreaker(config) {
             // Check if tool-level threshold exceeded. The block stays `>=` (Set.add is
             // idempotent), but the OPEN transition fires on the EXACT crossing only —
             // `===` so the bridge emits `tool:breaker_opened` once per open, never on
-            // every later failure (Pitfall 1 / T-151-03; a `>=` verdict would inflate
-            // Phase 153's breakerTimeline).
+            // every later failure (a `>=` verdict would inflate the incident report's
+            // breakerTimeline).
             if (toolState.count >= maxToolFailures) {
                 blockedTools.add(toolName);
             }
@@ -455,7 +451,7 @@ export function createToolRetryBreaker(config) {
             patternState.failingFingerprints.add(fp);
             errorPatternFailures.set(patternKey, patternState);
             const openedPattern = patternState.consecutiveFailures === maxErrorPatterns;
-            // Tool-WIDE open transition (A1): tool-level total OR error-pattern. The
+            // Tool-WIDE open transition: tool-level total OR error-pattern. The
             // args-specific signature-level counter does NOT emit a transition — it is
             // a narrower, self-healing state checked in beforeToolCall.
             if (openedToolLevel || openedPattern) {
@@ -463,13 +459,14 @@ export function createToolRetryBreaker(config) {
                     transition: "opened",
                     toolName,
                     reason: openedToolLevel ? "tool_failure_threshold" : "error_pattern",
-                    // Report the counter that actually crossed the threshold (WR-151-02).
+                    // Report the counter that actually crossed the threshold.
                     // A tool_failure_threshold open is driven by the tool-WIDE total
                     // (`toolState.count`) crossing maxToolFailures across different args —
                     // each individual signature may sit at consecutiveFailures===1. An
                     // error_pattern open is driven by the per-pattern consecutive counter.
                     // Reporting `sigState.consecutiveFailures` here mislabels an N-failure
-                    // open as "opened after 1 failure" in Phase 153's breakerTimeline.
+                    // open as "opened after 1 failure" in the incident report's
+                    // breakerTimeline.
                     consecutiveFailures: openedToolLevel
                         ? toolState.count
                         : patternState.consecutiveFailures,

package/node_modules/@comis/agent/dist/safety/tool-schema-safety.js

@@ -224,7 +224,8 @@ export function pruneToolSchemas(tools, excludeNames = new Set(["browser"])) {
         totalCharsRemoved += charsRemoved;
         return { ...tool, parameters: cloned };
     });
-    // flat-by-design: chars-REMOVED aggregate stat (TOK-01)
+    // An aggregate stat over chars REMOVED across many schemas — no single
+    // source string exists to script-factor (flat-by-design).
     const estimatedTokensSaved = Math.ceil(totalCharsRemoved / CHARS_PER_TOKEN_RATIO);
     return {
         tools: prunedTools,

package/node_modules/@comis/agent/dist/session/comis-session-manager.d.ts

@@ -37,7 +37,7 @@ export interface ComisSessionManagerDeps {
     /**
      * Optional logger. When provided, structured-cause logging fires before
      * withSessionLock collapses the FileLockPort's discriminated error union
-     * to the legacy 'locked' | 'error' string. Without it, operator triage
+     * to the coarse 'locked' | 'error' string. Without it, operator triage
      * cannot distinguish 'ELOCKED after N retries' from 'EACCES on the lock
      * directory'. The public Result API is unchanged either way.
      */
@@ -46,7 +46,7 @@ export interface ComisSessionManagerDeps {
      * Optional TypedEventBus. When provided, `destroySession` emits a
      * `session:ended` event with `exitReason: "destroyed"` BEFORE unlinking
      * the JSONL transcript (`session.ended`
-     * fires on session-destroy, NOT per-turn). When omitted (legacy / test
+     * fires on session-destroy, NOT per-turn). When omitted (test
      * harnesses, ephemeral sub-agent path), the emit step is a silent no-op
      * and `destroySession` still unlinks the file as before.
      *
@@ -79,7 +79,7 @@ export interface ComisSessionManagerDeps {
      * `<dataDir>/logs/session-index.YYYY-MM-DD.jsonl`.
      *
      * When omitted, defaults to `~/.comis` via `os.homedir()` so existing
-     * callers (tests, legacy harnesses) work without changes.
+     * callers (tests, standalone harnesses) work without changes.
      */
     dataDir?: string;
 }
@@ -108,7 +108,7 @@ export interface SessionMetadata {
     /** Executor-scope run ID; keys cost-tracker / token_usage rows. */
     runId?: string;
     /**
-     * T1.4 (F5): the formatted session key (the SAME value `comis explain` prints as
+     * The formatted session key (the SAME value `comis explain` prints as
      * `Session:`), stored so the metadata file is self-describing — an operator can drive
      * `comis explain '<sessionKey>'` straight from it instead of falling back to the traceId.
      */
@@ -120,7 +120,7 @@ export interface SessionMetadata {
         endReason: "success" | "error" | "timeout" | "budget_exceeded" | "budget_exhausted" | "circuit_open" | "provider_degraded" | "completed_with_tool_errors" | "context_exhausted" | "output_starved" | "narration_stall" | "spend_exceeded";
         durationMs: number;
         totalTokens: number;
-        /** Per-session health rollup (D5/F1) — additive optional on schemaVersion:1. */
+        /** Per-session health rollup — additive optional on schemaVersion:1. */
         degraded?: boolean;
         costUsd?: number;
         toolStats?: Record<string, {
@@ -161,8 +161,8 @@ export interface ComisSessionManager {
      * the same sessionKey are serialized. Different sessions do not block each other.
      *
      * SDK SessionManager.open() reads pre-existing JSONL session files at the
-     * mapped path, ensuring backward compatibility with sessions created by
-     * previous session files.
+     * mapped path, so conversations persisted by earlier daemon runs resume
+     * instead of being recreated.
      *
      * @param sessionKey - Comis session key identifying the conversation
      * @param fn - Callback that receives the SDK SessionManager and returns a result

package/node_modules/@comis/agent/dist/session/comis-session-manager.js

@@ -141,7 +141,7 @@ export function createComisSessionManager(deps) {
                 exitReason: "destroyed",
                 turnCount: 0,
                 totalTokens: 0,
-                source: "runtime", // D9 provenance stamp (production rows)
+                source: "runtime", // provenance stamp (production rows)
             });
             if (deps.trajectoryRegistry !== undefined) {
                 // Best-effort: close() swallows per-entry errors. Awaiting it

package/node_modules/@comis/agent/dist/session/orphaned-message-repair.d.ts

@@ -71,9 +71,8 @@ export interface ScrubResult {
  *
  * A block is "poisoned" when it has `type:"thinking"` with non-empty `thinking`
  * text but missing/empty `thinkingSignature` and `redacted !== true`. Such
- * blocks are legacy artifacts of an earlier persister that deleted the
- * signature but left the block in place; they cause Anthropic to reject
- * subsequent extended-thinking continuations.
+ * blocks cannot be replayed — Anthropic rejects subsequent extended-thinking
+ * continuations whose thinking blocks lack a valid signature.
  *
  * Removes poisoned blocks entirely from `message.content` (does not attempt
  * to repair them) and flushes via `_rewriteFile()` exactly once if any

package/node_modules/@comis/agent/dist/session/orphaned-message-repair.js

@@ -344,9 +344,8 @@ function repairMidSessionAnomalies(sessionManager) {
  *
  * A block is "poisoned" when it has `type:"thinking"` with non-empty `thinking`
  * text but missing/empty `thinkingSignature` and `redacted !== true`. Such
- * blocks are legacy artifacts of an earlier persister that deleted the
- * signature but left the block in place; they cause Anthropic to reject
- * subsequent extended-thinking continuations.
+ * blocks cannot be replayed — Anthropic rejects subsequent extended-thinking
+ * continuations whose thinking blocks lack a valid signature.
  *
  * Removes poisoned blocks entirely from `message.content` (does not attempt
  * to repair them) and flushes via `_rewriteFile()` exactly once if any

package/node_modules/@comis/agent/dist/session/sanitize-session-secrets.js

@@ -243,12 +243,12 @@ export function sanitizeSessionSecrets(sessionPath) {
         // ancestor-symlink defense lives at that boundary; this writer
         // remains a leaf consumer.
         //
-        // Substrate Result.err is intentionally discarded: the pre-migration
-        // contract was best-effort — the bare write call's throw was swallowed
-        // by the outer try/finally in `comis-session-manager.withWriteLock`,
-        // matching the existing semantics. The next reader still observes
-        // the unredacted on-disk state if the rewrite fails, but the inner
-        // `finally` semantics around the JSONL write lock are preserved.
+        // Substrate Result.err is intentionally discarded: the contract is
+        // best-effort — sanitization runs inside the session manager's
+        // try/finally while the write lock is held, and must never throw out
+        // of that finally. The next reader still observes the unredacted
+        // on-disk state if the rewrite fails, but the `finally` semantics
+        // around the JSONL write lock are preserved.
         writeRegularFile({ path: sessionPath, content: lines.join("\n") });
     }
     return totalChanged;

package/node_modules/@comis/agent/dist/session/scrub-redacted-tool-calls.d.ts

@@ -9,8 +9,8 @@
  *   JSONL is also what the SDK reads to rebuild the LLM context on the next
  *   turn. A model that sees its own prior `env_set` tool_use with
  *   `env_value: "[REDACTED]"` pattern-matches on it and sends "[REDACTED]"
- *   as the value on the NEXT env_set — which the daemon persists verbatim.
- *   Observed in production: CLOUDFLARE_ACCOUNT_ID stored as literal
+ *   as the value on the NEXT env_set — which the daemon persists verbatim,
+ *   leaving a real key (e.g. CLOUDFLARE_ACCOUNT_ID) stored as the literal
  *   "[REDACTED]" in ~/.comis/.env after an env_set-triggered daemon restart.
  *
  * Fix shape:

package/node_modules/@comis/agent/dist/session/scrub-redacted-tool-calls.js

@@ -10,8 +10,8 @@
  *   JSONL is also what the SDK reads to rebuild the LLM context on the next
  *   turn. A model that sees its own prior `env_set` tool_use with
  *   `env_value: "[REDACTED]"` pattern-matches on it and sends "[REDACTED]"
- *   as the value on the NEXT env_set — which the daemon persists verbatim.
- *   Observed in production: CLOUDFLARE_ACCOUNT_ID stored as literal
+ *   as the value on the NEXT env_set — which the daemon persists verbatim,
+ *   leaving a real key (e.g. CLOUDFLARE_ACCOUNT_ID) stored as the literal
  *   "[REDACTED]" in ~/.comis/.env after an env_set-triggered daemon restart.
  *
  * Fix shape:

package/node_modules/@comis/agent/dist/session/session-write-lock.d.ts

@@ -26,7 +26,7 @@ export interface LockedSessionStoreOptions {
     /**
      * Optional logger. When provided, structured-cause logging fires
      * before the FileLockPort's discriminated error union is collapsed to
-     * the legacy "locked" | "error" string. Without it, observability is
+     * the coarse "locked" | "error" string. Without it, observability is
      * limited to the collapsed return value — callers cannot distinguish
      * "ELOCKED after N retries" from "EACCES on the lock directory".
      *
@@ -50,8 +50,7 @@ export interface LockedSessionStoreOptions {
  * `fileLock` is injected by the caller — daemon composition passes the
  * `createFileLock()` instance built once at startup. The port handles
  * sentinel-file creation, stale-lock recovery, retry backoff, and the
- * ELOCKED → "locked" mapping that the legacy direct-proper-lockfile path
- * used to implement inline.
+ * ELOCKED → "locked" mapping.
  */
 export declare function withSessionLock<T>(fileLock: FileLockPort, lockDir: string, sessionKey: string, fn: () => T | Promise<T>, options?: LockedSessionStoreOptions): Promise<Result<T, "locked" | "error">>;
 /**

package/node_modules/@comis/agent/dist/session/session-write-lock.js

@@ -53,8 +53,7 @@ function deriveLockPath(lockDir, sessionKey) {
  * `fileLock` is injected by the caller — daemon composition passes the
  * `createFileLock()` instance built once at startup. The port handles
  * sentinel-file creation, stale-lock recovery, retry backoff, and the
- * ELOCKED → "locked" mapping that the legacy direct-proper-lockfile path
- * used to implement inline.
+ * ELOCKED → "locked" mapping.
  */
 export async function withSessionLock(fileLock, lockDir, sessionKey, fn, options) {
     const staleMs = options?.staleMs ?? DEFAULT_STALE_MS;
@@ -62,11 +61,11 @@ export async function withSessionLock(fileLock, lockDir, sessionKey, fn, options
     const retryMinTimeout = options?.retryMinTimeout ?? DEFAULT_RETRY_MIN_TIMEOUT;
     const sentinelPath = deriveLockPath(lockDir, sessionKey);
     // `fileLock.withLock` ensures the lockDir + sentinel file exist (the
-    // createFileLock adapter mkdir+writeFile-as-needed sequence preserves the
-    // pre-injection behavior here). It also catches thrown errors from `fn`
-    // and surfaces them as `err({ kind: "error" })` — we collapse the port's
-    // discriminated error union back to the legacy "locked" | "error" string
-    // so the public API of withSessionLock is unchanged.
+    // createFileLock adapter creates them on demand via mkdir+writeFile).
+    // It also catches thrown errors from `fn` and surfaces them as
+    // `err({ kind: "error" })` — we collapse the port's discriminated error
+    // union to the coarse "locked" | "error" string that withSessionLock's
+    // public API exposes.
     const lockResult = await fileLock.withLock(sentinelPath, async () => await fn(), {
         staleMs,
         retries: { retries, minTimeout: retryMinTimeout },

package/node_modules/@comis/agent/dist/spawn/announce-key.d.ts

@@ -2,14 +2,14 @@
  * Shared announcement idempotency-key construction + a bounded delivery-dedup
  * primitive, used by every sub-agent completion-delivery path.
  *
- * INFO-DRY: `buildAnnounceKey` is the single source of truth for the
+ * `buildAnnounceKey` is the single source of truth for the
  * `${callerSessionKey}::${runId}` key. The success path (`deliverAnnouncement`)
  * and the failure path (`deliverFailureNotification`) both build it; two
  * hand-rolled literals would silently diverge on any delimiter/operand change
- * and break the cross-path dedup (the DELIVERY-03 premise) with no test
- * catching the drift. One helper converts that into a one-edit guarantee.
+ * and break the cross-path dedup with no test catching the drift. One helper
+ * converts that into a one-edit guarantee.
  *
- * WR-02 / WR-03: `createDeliveryDedup` owns the delivered-key set OUTSIDE the
+ * `createDeliveryDedup` owns the delivered-key set OUTSIDE the
  * batcher so the no-batcher success branches can mark too (consistent dedup
  * whether or not a batcher is wired), and it is BOUNDED (FIFO eviction) like
  * every sibling structure in this subsystem (`runs` MAX_RUNS, the DLQ

package/node_modules/@comis/agent/dist/spawn/announce-key.js

@@ -3,14 +3,14 @@
  * Shared announcement idempotency-key construction + a bounded delivery-dedup
  * primitive, used by every sub-agent completion-delivery path.
  *
- * INFO-DRY: `buildAnnounceKey` is the single source of truth for the
+ * `buildAnnounceKey` is the single source of truth for the
  * `${callerSessionKey}::${runId}` key. The success path (`deliverAnnouncement`)
  * and the failure path (`deliverFailureNotification`) both build it; two
  * hand-rolled literals would silently diverge on any delimiter/operand change
- * and break the cross-path dedup (the DELIVERY-03 premise) with no test
- * catching the drift. One helper converts that into a one-edit guarantee.
+ * and break the cross-path dedup with no test catching the drift. One helper
+ * converts that into a one-edit guarantee.
  *
- * WR-02 / WR-03: `createDeliveryDedup` owns the delivered-key set OUTSIDE the
+ * `createDeliveryDedup` owns the delivered-key set OUTSIDE the
  * batcher so the no-batcher success branches can mark too (consistent dedup
  * whether or not a batcher is wired), and it is BOUNDED (FIFO eviction) like
  * every sibling structure in this subsystem (`runs` MAX_RUNS, the DLQ

package/node_modules/@comis/agent/dist/spawn/announcement-ports.d.ts

@@ -36,7 +36,7 @@ export interface QueuedAnnouncementShape {
     callerAgentId: string;
     callerSessionKey: string;
     runId: string;
-    /** Idempotency key `${callerSessionKey}::${runId}` (DELIVERY-01). Mirrors QueuedAnnouncement.idempotencyKey — keep in lockstep (D-MIRRORS). */
+    /** Idempotency key `${callerSessionKey}::${runId}`. Mirrors QueuedAnnouncement.idempotencyKey — keep in lockstep. */
     idempotencyKey?: string;
 }
 /**
@@ -49,9 +49,9 @@ export interface AnnouncementBatcher {
     flush(): Promise<void>;
     shutdown(): Promise<void>;
     readonly pending: number;
-    /** DELIVERY-01: has this idempotency key already been delivered? Mirrors the orchestrator batcher — keep in lockstep (D-MIRRORS / D-SHAREDDEDUP). Plan 03's failure path reads it. */
+    /** Has this idempotency key already been delivered? Mirrors the orchestrator batcher — keep in lockstep. The failure-notification path reads it too. */
     hasDelivered(key: string): boolean;
-    /** DELIVERY-01: mark an idempotency key delivered (success only). Mirrors the orchestrator batcher (D-MIRRORS). */
+    /** Mark an idempotency key delivered (success only). Mirrors the orchestrator batcher — keep in lockstep. */
     markDelivered(key: string): void;
 }
 /**
@@ -69,7 +69,7 @@ export interface DeadLetterEntryShape {
     lastAttemptAt: number;
     lastError?: string;
     threadId?: string;
-    /** Idempotency key `${callerSessionKey}::${runId}` (DELIVERY-01). Mirrors DeadLetterEntry.idempotencyKey — keep in lockstep (D-MIRRORS). */
+    /** Idempotency key `${callerSessionKey}::${runId}`. Mirrors DeadLetterEntry.idempotencyKey — keep in lockstep. */
     idempotencyKey?: string;
 }
 /**
@@ -83,10 +83,10 @@ export interface AnnouncementDeadLetterQueue {
         threadId?: string;
     }) => Promise<boolean>, 
     /**
-     * WR-01: invoked with the entry's `idempotencyKey` after a SUCCESSFUL
+     * Invoked with the entry's `idempotencyKey` after a SUCCESSFUL
      * re-delivery so the caller can mark the recovered key delivered (shared
      * deliveredKeys set) — otherwise a later failure sweep double-notifies.
-     * Mirrors the orchestrator DLQ signature (D-MIRRORS).
+     * Mirrors the orchestrator DLQ signature — keep in lockstep.
      */
     onDelivered?: (idempotencyKey: string) => void): Promise<void>;
     size(): number;

package/node_modules/@comis/agent/dist/spawn/child-prompt-economy.d.ts

@@ -1,15 +1,14 @@
 /**
- * Child-prompt economy (STRIP-01 / STRIP-02): drop the heavy inherited context
- * blocks from a READ-ONLY spawned child's assembled system prompt, on the SPAWN
- * side, while preserving the constitutional anti-injection safety core.
+ * Child-prompt economy: drop the heavy inherited context blocks from a
+ * READ-ONLY spawned child's assembled system prompt, on the SPAWN side, while
+ * preserving the constitutional anti-injection safety core.
  *
  * A read-only child still ingests untrusted web/MCP/file content, so it remains
- * a prompt-injection target and MUST keep the safety floor (Pitfall 5 / STRIP-5).
+ * a prompt-injection target and MUST keep the safety floor.
  * The drop narrows CONTEXT only — it never widens capability.
  *
  * ===========================================================================
- * Task-0 spike findings (Q-STRIP-1) — the spawn → child-prompt path at HEAD
- * (feature/v2.30). These pin the drop points + the chosen mechanism.
+ * The spawn → child-prompt path — the drop points + the chosen mechanism.
  * ===========================================================================
  *
  * 1. The child's resolved PromptMode.
@@ -18,8 +17,7 @@
  *    `resolvePromptModeForProfile(baseMode, operationType, modelProfile,
  *    compactPrompt)` (prompt-assembly.ts:981) — typically "full" for a
  *    frontier/mid child (or "compact-secure" for a small/nano child).
- *    The RESEARCH assumption (A3/A4 — that the "minimal" mode already drops the
- *    heavy STRIP-01 blocks) is CONFIRMED WRONG: in system-prompt-assembler.ts
+ *    No mode already drops the heavy blocks: in system-prompt-assembler.ts
  *    the heavy sections use MODES_ALL (incl. "minimal"), and the `m==="minimal"`
  *    flag only shortens each builder's TEXT — it does not OMIT the section.
  *    ⇒ a real drop mechanism is required; we cannot just pick a mode.
@@ -29,12 +27,10 @@
  *    are real SECTIONS in the assembled system-prompt string
  *    (system-prompt-assembler.ts SECTIONS table, lines 278-356), each emitting a
  *    stable `## <Heading>`, joined by SECTION_SEPARATOR ("\n\n---\n\n",
- *    system-prompt-assembler.ts:58). The RESEARCH "CLAUDE.md-equivalent overlay"
- *    maps to `## Project Context` (it injects AGENTS.md/ROLE.md — the project-
- *    instruction overlay, context-sections.ts:181). The RESEARCH "usage trailer"
- *    has NO Comis analogue in the prompt — token-budget is a DEBUG log line
- *    (prompt-assembly.ts:1989), never prompt text — so there is nothing to strip
- *    for it.
+ *    system-prompt-assembler.ts:58). `## Project Context` is the project-
+ *    instruction overlay (it injects AGENTS.md/ROLE.md, context-sections.ts:181).
+ *    Token-budget usage is a DEBUG log line (prompt-assembly.ts:1989), never
+ *    prompt text — so there is nothing to strip for it.
  *
  * 3. WHERE the safety core lives — same assembled string:
  *      - `## Safety`                        (core-sections.ts:28; ALWAYS the
@@ -47,12 +43,12 @@
  *    OWN assembled `systemPrompt` — split on SECTION_SEPARATOR, drop the sections
  *    whose heading is in READ_ONLY_CHILD_DROP_HEADINGS, keep everything else
  *    (so the safety core survives by construction). Rationale:
- *      (a) cap-safe — ALL logic lives here; the two capped files
- *          (sub-agent-runner.ts 2643L, prompt-assembly.ts 2035L) take only a
- *          single call-site hook (Task 2), no section-builder edits;
+ *      (a) cap-safe — ALL logic lives here; the two length-capped files
+ *          (sub-agent-runner.ts, prompt-assembly.ts) take only a
+ *          single call-site hook, no section-builder edits;
  *      (b) testable in isolation — pure string → string;
  *      (c) per-child — operates on the child's own assembled prompt, never the
- *          shared SECTIONS state (T-221-STRIP-03), and works on BOTH assembly
+ *          shared SECTIONS state, and works on BOTH assembly
  *          paths (full assembly + the parent-cache reuse path, prompt-assembly.ts
  *          806-974) because both yield a `systemPrompt` string.
  *
@@ -60,16 +56,16 @@
  */
 import type { SystemPromptBlocks } from "../bootstrap/index.js";
 /**
- * The heavy inherited section headings dropped for a read-only child (STRIP-01).
+ * The heavy inherited section headings dropped for a read-only child.
  * Each is a real `## <Heading>` emitted by the SECTIONS builders (see the
- * Task-0 spike notes above for the file:line of each). `## Project Context` is
- * the CLAUDE.md-equivalent overlay; `## Extended Thinking` / `## Reasoning
+ * module notes above for the file:line of each). `## Project Context` is
+ * the project-instruction overlay; `## Extended Thinking` / `## Reasoning
  * Format` are the two thinking-guidance variants the reasoning builder emits.
  */
 export declare const READ_ONLY_CHILD_DROP_HEADINGS: readonly string[];
 /**
- * The constitutional anti-injection floor that MUST survive the drop
- * (STRIP-5 / Pitfall 5). Used by the safety-core assertion; kept disjoint from
+ * The constitutional anti-injection floor that MUST survive the drop.
+ * Used by the safety-core assertion; kept disjoint from
  * the drop set by an arch-style test in child-prompt-economy.test.ts.
  */
 export declare const READ_ONLY_CHILD_KEEP_HEADINGS: readonly string[];
@@ -78,7 +74,7 @@ export declare const READ_ONLY_CHILD_KEEP_HEADINGS: readonly string[];
  * read-only (every tool ⊆ the read-only set per `isReadOnlyTool`), OR it
  * carries an explicit read-only role.
  *
- * Conservative by construction (T-221-STRIP-02): a child is read-only ONLY when
+ * Conservative by construction: a child is read-only ONLY when
  * we can PROVE it. Any tool that is not provably read-only — a mutating tool
  * (`exec`/`edit`/`write`/...) OR an unknown/unregistered tool — makes the child
  * NOT read-only, and a mutating tool overrides even an explicit read-only role
@@ -98,7 +94,7 @@ export declare function isReadOnlyChild(childToolNames: readonly string[], role?
 /**
  * Drop the heavy inherited blocks (READ_ONLY_CHILD_DROP_HEADINGS) from an
  * assembled child system prompt, preserving every other section — including the
- * full safety core (STRIP-01 + STRIP-5).
+ * full safety core.
  *
  * Splits on SECTION_SEPARATOR (the exact joiner the assembler uses), removes the
  * sections whose leading `## Heading` is in the drop set, and re-joins the
@@ -120,11 +116,11 @@ export interface EconomisedChildPrompt {
     systemPromptBlocks?: SystemPromptBlocks;
 }
 /**
- * Apply the read-only-child prompt economy on the SPAWN side (STRIP-02): if the
+ * Apply the read-only-child prompt economy on the SPAWN side: if the
  * child is read-only, drop the heavy inherited blocks from BOTH the assembled
  * `systemPrompt` string AND the `systemPromptBlocks.semiStableBody`; otherwise
  * pass everything through byte-identically (a mutating or unknown-tool child
- * gets the full prompt — conservative, T-221-STRIP-02).
+ * gets the full prompt — conservative).
  *
  * Both representations must be stripped because the multi-block path
  * (request-body/breakpoint-orchestration.ts) builds the system message from