comisai 1.0.45 → 1.0.46

package/node_modules/@comis/agent/dist/spawn/steer-run.js

@@ -1,16 +1,16 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * steerRun — the live-child inject mechanism for STEER-01 (Phase 175).
+ * steerRun — the live-child inject mechanism for mid-flight steering.
  *
- * Extracted from sub-agent-runner.ts (which is over the §2.8 800-line cap) so
+ * Extracted from sub-agent-runner.ts (which is over the 800-line module cap) so
  * the heavy mechanism does not grow that file. The runner exposes a thin
  * `steerRun(runId, message)` method that delegates here.
  *
- * MECHANISM (RESEARCH §Pattern 1 + 175-00-SUMMARY A1 resolution):
+ * MECHANISM:
  *   1. resolve the RUNNING child's live RunHandle via the SAME lookup killRun
  *      uses for abort() — `resolveActiveSession(deriveCompositeForRun(run))`
  *      (sub-agent-runner.ts:1936). The by-sessionKey `activeRunRegistry.get`
- *      is the documented fallback (175-00 confirmed the composite resolves).
+ *      is the fallback (the composite lookup resolves today).
  *   2. inject via the channel-path streaming-aware branch (setup-and-route.ts:267):
  *        isStreaming() && !isCompacting() ? handle.steer(msg) : handle.followUp(msg)
  *      — the message lands at the child's NEXT STEP BOUNDARY after transcript
@@ -19,14 +19,14 @@
  * NEVER: killRun, spawn, or run.status mutation — the run's identity
  * (runId/transcript/progress) is preserved (kill ≠ steer). A steer is a
  * MESSAGE, never a tool grant — this helper has no path to tool assembly, so
- * the child's spawn-fixed denylist still governs (Task 3 proves the runtime
- * classification a steered denied-tool request hits).
+ * the child's spawn-fixed denylist still governs (a steered denied-tool request
+ * hits the same runtime classification as any other denied call).
  *
  * Result-shaped per AGENTS.md §2.1 (mirrors killRun's `{killed, error?}` →
  * `{steered, mode?, error?}`); the daemon RPC handler (`@allow-throw`) maps a
  * `!steered` result to a thrown JSON-RPC error.
  *
- * L2 TYPE-SURFACE NOTE: SteerRunDeps declares the FULL `RunHandle`
+ * TYPE-SURFACE NOTE: SteerRunDeps declares the FULL `RunHandle`
  * (steer/followUp/isStreaming/isCompacting) — it needs all four. The RUNNER's
  * SubAgentRunnerDeps.sessionResolver/activeRunRegistry are deliberately
  * narrowed to `{ abort(): Promise<void> }` (sub-agent-runner.ts:219-233) to
@@ -58,12 +58,12 @@ import { parseFormattedSessionKey } from "@comis/core";
  *     — the executor never keys on the announce channelId; it keys on
  *     subSessionKey.channelId)
  *
- * WR-01 (175-REVIEW.md): the prior formula used `"sub-agent"` for channelType
- * and `run.announceChannelId ?? parsed?.channelId` for channelId, which DIVERGED
- * from the registration key and made `steerRun` return `{steered:false}` for a
- * genuinely-running sub-agent (and made the kill/ghost/watchdog abort lookups
+ * PITFALL: a formula using `"sub-agent"` for channelType or
+ * `run.announceChannelId ?? parsed?.channelId` for channelId DIVERGES
+ * from the registration key and makes `steerRun` return `{steered:false}` for a
+ * genuinely-running sub-agent (and makes the kill/ghost/watchdog abort lookups
  * silently miss — best-effort there, so latent, but fatal for steer). Mirror the
- * IDENTICAL formula in sub-agent-runner.ts:`deriveCompositeForRun`; the 175-00
+ * IDENTICAL formula in sub-agent-runner.ts:`deriveCompositeForRun`; the resolution
  * spike (sub-agent-runner.steer-resolve.spike.test.ts) fails loudly on drift.
  */
 function deriveCompositeForRun(run) {
@@ -76,10 +76,10 @@ function deriveCompositeForRun(run) {
 }
 /**
  * Test-only alias for the module-private {@link deriveCompositeForRun}. The
- * 175-00 A1 spike (sub-agent-runner.steer-resolve.spike.test.ts) imports the
+ * resolution spike (sub-agent-runner.steer-resolve.spike.test.ts) imports the
  * REAL formula so a drift between it and the executor registration key
  * (pi-executor.ts:1152-1156) fails loudly — NOT a reconstructed replica
- * (WR-01 correction: the old inline replica made the drift guard a tautology).
+ * (an inline replica would make the drift guard a tautology).
  * @internal
  */
 export const deriveCompositeForRunForTest = deriveCompositeForRun;
@@ -97,7 +97,7 @@ export async function steerRun(deps, runId, message) {
     if (!run) {
         return { steered: false, error: `Unknown run ID: ${runId}` };
     }
-    // Resolve the live handle via the A1-chosen composite lookup (the same lookup
+    // Resolve the live handle via the composite lookup (the same lookup
     // killRun uses for abort), falling back to the by-sessionKey registry.
     const handle = deps.sessionResolver?.resolveActiveSession(deriveCompositeForRun(run)) ??
         deps.activeRunRegistry?.get(run.sessionKey);

package/node_modules/@comis/agent/dist/spawn/sub-agent-result-processor.d.ts

@@ -122,7 +122,7 @@ export declare function deliverAnnouncement(params: {
     batcher?: AnnouncementBatcher;
     deadLetterQueue?: AnnouncementDeadLetterQueue;
     /**
-     * WR-02: shared, bounded delivered-key store. When the batcher is absent the
+     * Shared, bounded delivered-key store. When the batcher is absent the
      * batcher cannot mark the key, so the non-batcher success branches mark this
      * sink instead — keeping the failure-path dedup (`deliverFailureNotification`)
      * correct whether or not a batcher is wired. The daemon wiring injects the
@@ -137,15 +137,15 @@ export declare function deliverAnnouncement(params: {
  * the circular dependency when the LLM provider is the cause of the failure.
  * Never throws -- delivery errors are logged as warnings.
  *
- * DEFER-171-01 (WR-04): this path is SINGLE-ATTEMPT by design. DELIVERY-03's
- * requirement was failure-path IDEMPOTENCY (the shared dedup above), NOT the
- * transient retry/DLQ self-healing the SUCCESS fallback got in DELIVERY-02
+ * DELIBERATE ASYMMETRY: this path is SINGLE-ATTEMPT by design. The failure
+ * path's requirement is IDEMPOTENCY (the shared dedup above), NOT the
+ * transient retry/DLQ self-healing the SUCCESS fallback has
  * (`sendWithRetry` in the batcher). Mirroring that here means injecting the
  * classifier/backoff/maxRetries/eventBus (and a DLQ) and a parallel retry loop
- * — a materially restructured failure path, out of scope for P0-B. The
+ * — a materially restructured failure path. The
  * asymmetry with the hardened success path is therefore a documented decision,
- * not an oversight (see the phase deferred-items.md). On a transient transport
- * blip the notification is dropped (logged with a hint), pending that follow-up.
+ * not an oversight. On a transient transport
+ * blip the notification is dropped (logged with a hint).
  */
 export declare function deliverFailureNotification(params: {
     channelType: string;
@@ -153,12 +153,12 @@ export declare function deliverFailureNotification(params: {
     task: string;
     runtimeMs: number;
     runId: string;
-    /** DELIVERY-03: formatted caller session key — needed to build the shared announceKey. */
+    /** Formatted caller session key — needed to build the shared announceKey. */
     callerSessionKey?: string;
 }, deps: Pick<SubAgentRunnerDeps, "sendToChannel" | "logger" | "batcher"> & {
     /**
-     * WR-02: shared, bounded delivered-key store. Lets the failure-path dedup
-     * work WITHOUT a batcher (the batcher used to be the only sink). When both a
+     * Shared, bounded delivered-key store. Lets the failure-path dedup
+     * work WITHOUT a batcher. When both a
      * batcher and a dedup are injected they are the SAME underlying set (the
      * batcher delegates to it), so checking/marking either is consistent.
      */

package/node_modules/@comis/agent/dist/spawn/sub-agent-result-processor.js

@@ -42,11 +42,11 @@ export function classifyAbortReason(finishReason, errorMessage, errorCause) {
                 severity: "actionable",
             };
         case "spend_exceeded":
-            // WR-3 (177-obs-loop): the dollars kill-switch abort. Reuses the existing
+            // The dollars kill-switch abort. Reuses the existing
             // budget category with the actionable observability.spend.* hint emitSpendAbort
             // (bridge-safety-controls.ts) already uses — NOT the default "check daemon
-            // logs" catch-all (the wrong-way, non-actionable pointer the security review
-            // flagged for a spend-killed sub-agent).
+            // logs" catch-all (a wrong-way, non-actionable pointer for a spend-killed
+            // sub-agent).
             return {
                 category: "budget",
                 hint: "Spend ceiling exceeded; raise observability.spend.* (perAgentUsd / perTenantUsd / daemonGlobalUsd) or set observability.spend.action:'warn'",
@@ -209,7 +209,7 @@ export async function persistFailureRecord(params, logger) {
 // Error context classification
 // ---------------------------------------------------------------------------
 /**
- * Transport-layer failures are transient (DELIVERY-02): they self-heal on a
+ * Transport-layer failures are transient: they self-heal on a
  * retry-with-backoff in the announcement batcher. The bare Node errno spellings
  * do NOT contain "timeout"/"timed out" (e.g. "ETIMEDOUT".toLowerCase() is
  * "etimedout"), so the existing timeout branch misses them — match these
@@ -217,7 +217,7 @@ export async function persistFailureRecord(params, logger) {
  * (real delivery errors wrap the errno in surrounding text, e.g.
  * "connect ECONNREFUSED 127.0.0.1:443").
  *
- * INFO-CLASSIFIER: deliberately errno-style only, PLUS the errno-less real
+ * The token list is deliberately errno-style only, PLUS the errno-less real
  * phrasings emitted by undici/fetch ("fetch failed", "network request failed",
  * "socket hang up"). The natural-language phrases "connection reset" /
  * "connection refused" are intentionally OMITTED: every genuine Node transport
@@ -271,7 +271,7 @@ export function classifyErrorContext(errorMessage, endReason) {
                 retryable = true;
             }
             else if (TRANSIENT_TRANSPORT_TOKENS.some((token) => lowerMsg.includes(token))) {
-                // DELIVERY-02: transport-layer blips (ECONNRESET/ECONNREFUSED/EPIPE/
+                // Transport-layer blips (ECONNRESET/ECONNREFUSED/EPIPE/
                 // "socket hang up"/"fetch failed"/...) are transient — the batcher
                 // retries them with backoff before dead-lettering. Placed AFTER the
                 // budget/timeout branches (which precede it) so a permanent budget
@@ -423,7 +423,7 @@ export function stripAnnouncementInstruction(text) {
  */
 export async function deliverAnnouncement(params, deps) {
     const { announceChannelType, announceChannelId, callerAgentId, callerSessionKey, runId } = params;
-    // DELIVERY-01 / INFO-DRY: build the idempotency key ONCE here via the shared
+    // Build the idempotency key ONCE here via the shared
     // helper (single source of truth — the failure path uses the same builder),
     // then thread it as data through the batcher and the dead-letter entry; never
     // reconstruct it downstream. Undefined for a top-level spawn (no callerSessionKey).
@@ -457,7 +457,7 @@ export async function deliverAnnouncement(params, deps) {
             if (!parentSk)
                 throw new Error(`Invalid parent session key: ${callerSessionKey}`);
             await withTimeout(deps.announceToParent(callerAgentId, parentSk, announcementText, announceChannelType, announceChannelId), ANNOUNCE_PARENT_TIMEOUT_MS, systemScheduleTimeout, "announceToParent");
-            // WR-02: mark delivered on this non-batcher success branch (there is no
+            // Mark delivered on this non-batcher success branch (there is no
             // batcher here to mark) so the failure path dedups. Marked ONLY after the
             // confirmed await — a failed/timed-out injection falls through to the
             // direct send below and stays unmarked.
@@ -481,9 +481,9 @@ export async function deliverAnnouncement(params, deps) {
     const threadId = ctx?.deliveryOrigin?.threadId;
     try {
         const ok = await deps.sendToChannel(announceChannelType, announceChannelId, stripAnnouncementInstruction(announcementText), threadId ? { threadId } : undefined);
-        // WR-02: mark delivered ONLY on a confirmed success (ok === true). A throw
+        // Mark delivered ONLY on a confirmed success (ok === true). A throw
         // or a `false` return (transport refused without throwing) leaves the key
-        // open so the failure path / a retry can re-notify (Pitfall 3).
+        // open so the failure path / a retry can re-notify.
         if (ok && announceKey)
             deps.deliveryDedup?.mark(announceKey);
     }
@@ -506,7 +506,7 @@ export async function deliverAnnouncement(params, deps) {
                 attemptCount: 0,
                 lastError: sendErr instanceof Error ? sendErr.message : String(sendErr),
                 threadId, // Persist thread context for retried deliveries
-                idempotencyKey: announceKey, // DELIVERY-01: same key threaded onto the DLQ entry
+                idempotencyKey: announceKey, // same key threaded onto the DLQ entry
             });
         }
     }
@@ -521,15 +521,15 @@ export async function deliverAnnouncement(params, deps) {
  * the circular dependency when the LLM provider is the cause of the failure.
  * Never throws -- delivery errors are logged as warnings.
  *
- * DEFER-171-01 (WR-04): this path is SINGLE-ATTEMPT by design. DELIVERY-03's
- * requirement was failure-path IDEMPOTENCY (the shared dedup above), NOT the
- * transient retry/DLQ self-healing the SUCCESS fallback got in DELIVERY-02
+ * DELIBERATE ASYMMETRY: this path is SINGLE-ATTEMPT by design. The failure
+ * path's requirement is IDEMPOTENCY (the shared dedup above), NOT the
+ * transient retry/DLQ self-healing the SUCCESS fallback has
  * (`sendWithRetry` in the batcher). Mirroring that here means injecting the
  * classifier/backoff/maxRetries/eventBus (and a DLQ) and a parallel retry loop
- * — a materially restructured failure path, out of scope for P0-B. The
+ * — a materially restructured failure path. The
  * asymmetry with the hardened success path is therefore a documented decision,
- * not an oversight (see the phase deferred-items.md). On a transient transport
- * blip the notification is dropped (logged with a hint), pending that follow-up.
+ * not an oversight. On a transient transport
+ * blip the notification is dropped (logged with a hint).
  */
 export async function deliverFailureNotification(params, deps) {
     const taskPreview = params.task.length > 100
@@ -540,15 +540,15 @@ export async function deliverFailureNotification(params, deps) {
         "The task encountered an error and could not complete.",
         `Runtime: ${(params.runtimeMs / 1000).toFixed(1)}s`,
     ].join("\n");
-    // DELIVERY-03 / INFO-DRY: build the SAME idempotency key as the success path
+    // Build the SAME idempotency key as the success path
     // via the shared `buildAnnounceKey` helper (one source of truth — divergence
     // would silently break the cross-path dedup) and dedup against the SAME
-    // deliveredKeys set (reached via the batcher's hasDelivered/markDelivered,
-    // D-SHAREDDEDUP). A Phase-170 budget-failed node routes here; its failure-key
+    // deliveredKeys set (reached via the batcher's hasDelivered/markDelivered).
+    // A budget-failed graph node routes here; its failure-key
     // == its success-key, so a second sweep does not double-notify. Undefined for
-    // a top-level spawn (no callerSessionKey) → no dedup, behaves as today.
+    // a top-level spawn (no callerSessionKey) → no dedup.
     const announceKey = buildAnnounceKey(params.callerSessionKey, params.runId);
-    // WR-02: dedup against the shared set whether reached via the batcher OR the
+    // Dedup against the shared set whether reached via the batcher OR the
     // directly-injected DeliveryDedup (the no-batcher path). They are the same
     // underlying set in production; checking either suppresses a double-notify.
     const alreadyDelivered = announceKey !== undefined
@@ -566,9 +566,9 @@ export async function deliverFailureNotification(params, deps) {
     const threadId = ctx?.deliveryOrigin?.threadId;
     try {
         await deps.sendToChannel(params.channelType, params.channelId, message, threadId ? { threadId } : undefined);
-        // Mark delivered ONLY after a successful send (Pitfall 3 — a failed send
+        // Mark delivered ONLY after a successful send (a failed send
         // must stay retry-eligible / re-notifiable). Mark BOTH sinks: the batcher
-        // (when wired) and the shared dedup (WR-02 — so dedup holds without a
+        // (when wired) and the shared dedup (so dedup holds without a
         // batcher). Both resolve to the same set in production. No-op without a key.
         if (announceKey) {
             deps.batcher?.markDelivered(announceKey);

package/node_modules/@comis/agent/dist/spawn/sub-agent-runner.d.ts

@@ -46,11 +46,11 @@ export interface SubAgentRun {
     requesterOrigin?: DeliveryOrigin;
     /** Spawn depth in the chain (0 = first child, 1 = grandchild, etc.). */
     depth: number;
-    /** Tree-stable run identity (CEIL-01/REVOKE-03). Every run belongs to exactly one
+    /** Tree-stable run identity. Every run belongs to exactly one
      *  spawn tree; the root mints this id and descendants inherit it. The unified
      *  semaphore keys on it and killByRootRun enumerates a whole tree by it. */
     rootRunId: string;
-    /** Lease that authorized this spawn (REVOKE-02 cascade correlation); undefined for the root. */
+    /** Lease that authorized this spawn (revocation-cascade correlation); undefined for the root. */
     parentLeaseId?: string;
     /** Session key of the caller agent, used for active children counting. */
     callerSessionKey?: string;
@@ -64,7 +64,7 @@ export interface SubAgentRun {
     nodeId?: string;
     /** Abort/cleanup group key. Graph spawns: `graph:${graphId}`. Regular: callerSessionKey. */
     abortGroup?: string;
-    /** Phase 213 CR-02: true when this run reserved a tree-wide ceiling slot
+    /** True when this run reserved a tree-wide ceiling slot
      *  (`checkSpawnCeiling` returned ok). The slot is released EXACTLY ONCE on the
      *  run's first terminal transition (`releaseCeilingSlotOnce` clears the flag),
      *  so a kill→later-settle or a double-fired completion never double-releases
@@ -90,7 +90,7 @@ export interface SubAgentRunnerDeps {
         reuseSessionKey?: string;
         graphNodeDepth?: number;
     }, 
-    /** Per-spawn token budget — becomes the child's BudgetGuard per-execution cap (BUDGET-01). */
+    /** Per-spawn token budget — becomes the child's BudgetGuard per-execution cap. */
     tokenBudget?: number) => Promise<{
         response: string;
         tokensUsed: {
@@ -124,7 +124,7 @@ export interface SubAgentRunnerDeps {
     tenantId: string;
     /**
      * Resolve an agent's sandbox posture from its per-agent skills config
-     * (SANDBOX-01) for the fail-closed no-downgrade gate (SANDBOX-02). Injected by
+     * for the fail-closed no-downgrade gate. Injected by
      * the daemon wiring (which holds `container.config.agents`); the runner stays a
      * `@comis/agent` leaf with no full-config import — it never reaches
      * `config.agents[...]` itself. The two-arg form mirrors the daemon's
@@ -135,12 +135,12 @@ export interface SubAgentRunnerDeps {
      */
     resolvePosture?: (agentId: string, callerAgentId?: string) => SandboxPosture;
     /**
-     * Tree-wide spawn ceiling consult (CEIL-01). Called at the spawn chokepoint —
+     * Tree-wide spawn ceiling consult. Called at the spawn chokepoint —
      * the SINGLE convergence point `session.spawn`, `graph.*`, AND the in-process
      * agent loop ALL hit (they all call `runner.spawn`) — so a `for(;;) spawn()`
      * fork-bomb is bounded tree-wide where the per-caller depth/fanout gates cannot
-     * (RESEARCH anti-pattern: "a semaphore that only sees the cap-endpoint path
-     * misses the in-process path"). Receives the run's tree-stable `rootRunId`, the
+     * (a semaphore that only sees the cap-endpoint path
+     * misses the in-process path). Receives the run's tree-stable `rootRunId`, the
      * `depth`, and the active-children `fanout`. On `{ ok:false }` the spawn is
      * rejected EXACTLY like the depth/children gates (event + WARN + no run/session
      * created). **Absent ⇒ inert** (non-daemon constructions / older test wiring);
@@ -153,12 +153,12 @@ export interface SubAgentRunnerDeps {
         reason: string;
     };
     /**
-     * Symmetric release of a slot reserved by {@link checkSpawnCeiling} (Phase 213
-     * CR-02). Called 1:1 with every successful acquire on EVERY terminal transition
+     * Symmetric release of a slot reserved by {@link checkSpawnCeiling}.
+     * Called 1:1 with every successful acquire on EVERY terminal transition
      * of the run that reserved it — the run-completion `finally` and the queue-
      * timeout fail path. Without it the per-`rootRunId` `active` counter only ever
      * increments and a tree is bricked after `maxConcurrentSelfAgents` spawns
-     * (a permanent spawn brick, masked pre-CR-01 only because roots never shared).
+     * (a permanent spawn brick — masked only while roots never share a counter).
      * Idempotent at the sink (the semaphore floors `active` at 0). **Absent ⇒
      * inert** (older/non-daemon wiring); the daemon wires it to
      * `boundedAutonomy.releaseSpawn`.
@@ -192,7 +192,7 @@ export interface SubAgentRunnerDeps {
     /** Optional dead-letter queue for persisting failed announcement deliveries */
     deadLetterQueue?: AnnouncementDeadLetterQueue;
     /**
-     * WR-02: shared, bounded delivered-key store, forwarded to deliverAnnouncement
+     * Shared, bounded delivered-key store, forwarded to deliverAnnouncement
      * + deliverFailureNotification so the failure-path dedup is correct whether or
      * not a batcher is wired. The daemon injects the SAME instance the batcher uses.
      */
@@ -303,7 +303,7 @@ export interface SubAgentRunnerDeps {
             tokensUsed: number;
             cost: number;
             sessionKey: string;
-            /** Phase 218 (SUMREF-02): the materialized full-output handle, when produced. */
+            /** The materialized full-output handle, when produced. */
             resultRef?: ResultRef;
         }): string;
     };
@@ -314,7 +314,7 @@ export interface SubAgentRunnerDeps {
     /** Timer scheduling. Sweep-interval + watchdog setTimeout + shutdown-timeout setTimeout. */
     timers: TimerPort;
     /**
-     * Phase 216 (DUR-01 / HB-01): the durable-run checkpoint store. OPTIONAL — when
+     * The durable-run checkpoint store. OPTIONAL — when
      * present (the daemon wires it ONLY when `autonomy.durability.enabled` AND an
      * autonomy agent is configured), `spawn()` writes a per-root checkpoint at the
      * spawn boundary + refreshes a keep-alive heartbeat on the injected timer, and
@@ -325,10 +325,10 @@ export interface SubAgentRunnerDeps {
      */
     durableRuns?: DurableRunPort;
     /**
-     * Phase 216 (HB-01): the keep-alive cadence + lapsed threshold (from
+     * The keep-alive cadence + lapsed threshold (from
      * `autonomy.durability`). `keepAliveMs` drives the heartbeat-refresh interval
      * (independent of step/spawn completion so a long-running child never looks
-     * stale — Pitfall 4). Optional alongside {@link durableRuns}; defaults applied
+     * stale). Optional alongside {@link durableRuns}; defaults applied
      * when absent.
      */
     durability?: {
@@ -336,7 +336,7 @@ export interface SubAgentRunnerDeps {
         staleHeartbeatMs: number;
     };
     /**
-     * Phase 216 (DUR-01): resolve the durable-checkpoint facts for a tree root —
+     * Resolve the durable-checkpoint facts for a tree root —
      * the ATTENUATED caps the run was minted with (the lease's caps), the correlated
      * `leaseIds` (BoundedAutonomy.leaseIdsForRoot), and the consumed budget (the
      * budget `snapshot`). Injected by the daemon wiring (which holds the
@@ -380,7 +380,7 @@ export interface SubAgentRunnerDeps {
         }): Promise<void>;
     };
     /**
-     * Phase 218 (SUMREF-02): materialize the child's FULL output to the CHILD's
+     * Materialize the child's FULL output to the CHILD's
      * own jailed workspace as a structured {@link ResultRef} (preview + ref +
      * bytes + kind), so the lead's announcement carries a bounded summary + a
      * HANDLE instead of the megabyte body (the longevity invariant). The daemon
@@ -395,8 +395,8 @@ export interface SubAgentRunnerDeps {
      *
      * `ctx.agentId` is the CHILD's agent id — the daemon resolves the materialize
      * target (`resolveWorkspaceDir(config[agentId], agentId, dataDir)`) from it so
-     * the write lands in the CHILD's OWN jailed workspace, NEVER the lead's
-     * (T-218-08); the store is additionally `safePath`-confined to that root.
+     * the write lands in the CHILD's OWN jailed workspace, NEVER the
+     * lead's; the store is additionally `safePath`-confined to that root.
      */
     materializeFullOutput?: (content: string, ctx: {
         runId: string;
@@ -415,9 +415,9 @@ export interface SpawnParams {
     announceChannelId?: string;
     model?: string;
     max_steps?: number;
-    /** Per-spawn token budget — becomes the child's BudgetGuard per-execution cap (BUDGET-01).
+    /** Per-spawn token budget — becomes the child's BudgetGuard per-execution cap.
      *  Threaded SpawnParams -> ExecuteSubAgentFn -> ExecutionOverrides -> resetExecution(cap).
-     *  When absent, the child enforces config.perExecution exactly as today. */
+     *  When absent, the child enforces config.perExecution unchanged. */
     tokenBudget?: number;
     expected_outputs?: string[];
     /** Originating channel context for default announcement routing */
@@ -426,30 +426,30 @@ export interface SpawnParams {
     depth?: number;
     /** Maximum allowed spawn depth from config. */
     maxDepth?: number;
-    /** Tree-stable run identity (CEIL-01/REVOKE-03). Established ONCE at the root spawn
-     *  (depth 0) and propagated to every descendant so the tree-wide semaphore (Plan 04)
+    /** Tree-stable run identity. Established ONCE at the root spawn
+     *  (depth 0) and propagated to every descendant so the tree-wide semaphore
      *  and kill-by-root primitive see one id per spawn tree. When absent, spawn() mints
      *  one (the root); a child MUST pass its parent's id down — a fresh id per child would
-     *  escape the parent's ceiling (RESEARCH Pitfall 1 — the silent under-count). */
+     *  escape the parent's ceiling (a silent under-count). */
     rootRunId?: string;
-    /** Lease that authorized this spawn (REVOKE-02 cascade correlation). Recorded on the
+    /** Lease that authorized this spawn (revocation-cascade correlation). Recorded on the
      *  run so a future revoke-by-root can map runs to leases; omitted for the root. */
     parentLeaseId?: string;
     /**
-     * Phase 216 (MED-4 cronOrigin): the REAL cron signal carried from the cron-fire
+     * The REAL cron signal carried from the cron-fire
      * turn metadata (`metadata.isCronAgentTurn` — see prompt-assembly.ts:676). When
      * a sub-agent is spawned during a cron-fired turn, the caller threads this from
      * the turn metadata so the durable checkpoint records a non-null `cronOrigin`
      * (the jobId). A non-cron spawn leaves it false → cronOrigin = null. There is NO
-     * `cronOrigin` string at HEAD — the runner DERIVES it from this flag + jobId.
+     * `cronOrigin` string parameter — the runner DERIVES it from this flag + jobId.
      */
     isCronAgentTurn?: boolean;
-    /** Phase 216 (MED-4): the firing cron job's id — the cronOrigin value when `isCronAgentTurn`. */
+    /** The firing cron job's id — the cronOrigin value when `isCronAgentTurn`. */
     jobId?: string;
-    /** Phase 216 (MED-4): the firing cron job's name — the cronOrigin fallback when jobId is absent. */
+    /** The firing cron job's name — the cronOrigin fallback when jobId is absent. */
     jobName?: string;
     /**
-     * Phase 216 (DUR-01): the ATTENUATED caps this run was minted with (the lease's
+     * The ATTENUATED caps this run was minted with (the lease's
      * caps). Threaded from the spawn caller (the cap layer / cron-fire mint) so the
      * durable checkpoint records the exact caps a resume must re-mint VERBATIM
      * (never re-attenuated). When absent, `durableRunFacts` (deps) is consulted; if
@@ -466,8 +466,8 @@ export interface SpawnParams {
     domainKnowledge?: string[];
     /** Tool group names for sub-agent tool filtering. */
     toolGroups?: string[];
-    /** Inherited reply language (DET-02 tag) from the parent ALS; persisted into child
-     *  session metadata as `language` so it survives the spawn round-trip (GEN-03). */
+    /** Inherited reply language from the parent ALS; persisted into child
+     *  session metadata as `language` so it survives the spawn round-trip. */
     resolvedLanguage?: string;
     /** Optional list of tool names that must be reachable by the sub-agent.
      *  Validated at spawn time against the daemon-provided reachableToolNames set.
@@ -513,14 +513,14 @@ export interface SpawnParams {
      *  because their cache prefix has no downstream consumers. */
     isLeafNode?: boolean;
     /**
-     * WT-01: run this child in an ISOLATED git worktree (its own working tree on a
+     * Run this child in an ISOLATED git worktree (its own working tree on a
      * fresh branch rooted under the child's jailed workspace) so parallel children
      * never clobber each other's files. The runner is @comis/skills-free, so it does
      * NOT create the worktree itself — it persists this flag onto the child session
      * metadata (`worktree`), and the daemon's executeSubAgent (which holds the
      * GitExec seam + the workspace resolver) reads the metadata, creates the
      * worktree, runs the child in it, and auto-cleans-if-unchanged on completion.
-     * Absent/false ⇒ the child runs in its normal jailed workspace (today's path).
+     * Absent/false ⇒ the child runs in its normal jailed workspace (the default).
      */
     worktree?: boolean;
 }