comisai 1.0.45 → 1.0.46

package/node_modules/@comis/core/dist/event-bus/events-orchestration.d.ts

@@ -2,23 +2,22 @@
  * OrchestrationEvents: multi-agent graph orchestration lifecycle events
  * (graph:* + subagent:*).
  *
- * Extracted from AgentEvents (Phase 170-02) so the graph coordinator's
+ * Extracted from AgentEvents so the graph coordinator's
  * lifecycle surface lives as one cohesive domain group — mirroring how
  * TerminalEvents / MediaGenerationEvents are their own sub-interfaces folded
  * into EventMap. The graph engine emits a start signal, a per-node transition,
- * a terminal completion, a typed-driver lifecycle phase, and (BUDGET-03) a
- * per-node token-budget breach. `pipeline:authored` (P1/TELEM-01) is the
+ * a terminal completion, a typed-driver lifecycle phase, and a
+ * per-node token-budget breach. `pipeline:authored` is the
  * authoring half of the same graph subsystem — a counts-only signal per
- * `pipeline` tool invocation. `graph:repaired` (P2/AUTHOR-01) and
- * `graph:synthesized_from_intent` (P2/AUTHOR-02) are the audit half — one
- * counts-only signal per conservative repair / intent-synthesis (the producers
- * the P1 `repaired` flag documented as deferred).
+ * `pipeline` tool invocation. `graph:repaired` and
+ * `graph:synthesized_from_intent` are the audit half — one
+ * counts-only signal per conservative repair / intent-synthesis.
  *
  * Counts / ids / typed enums ONLY — NEVER task text, sub-agent output, or
  * response bodies. The breach event (`subagent:budget_exceeded`) carries the
  * two token numbers and the ids and nothing else (AGENTS.md §2.7); every
  * payload is reconstructable from the bus alone. `subagent:steered`
- * (STEER-01, Phase 175) is the in-flight-steer half of the same sub-agent
+ * is the in-flight-steer half of the same sub-agent
  * lifecycle — a counts/ids/typed-enum-mode signal per real steer-inject (the
  * message body never crosses the bus).
  */
@@ -32,7 +31,7 @@ export interface OrchestrationEvents {
         timestamp: number;
     };
     /**
-     * Finding D (30uc-20260624, TREE-01): a graph DAG node was spawned. Bridged to
+     * A graph DAG node was spawned. Bridged to
      * the trajectory (`graph.node_spawned`) so `comis explain`'s spawn-tree
      * reconstructs each node as a leaf — a graph node spawns in-process and never
      * crosses the socket chokepoint that emits `capability:audited`, so without this
@@ -43,11 +42,11 @@ export interface OrchestrationEvents {
     "graph:node_spawned": {
         graphId: string;
         nodeId: string;
-        /** The tree-stable graph root (Phase 213 CR-01) every node shares. */
+        /** The tree-stable graph root every node shares. */
         rootRunId: string;
         /** The node's CHILD agent (node.agentId ?? defaultAgentId). */
         agentId: string;
-        /** The resolved per-node token cap (BUDGET-03), or null when unbounded. */
+        /** The resolved per-node token cap, or null when unbounded. */
         tokenBudget: number | null;
         timestamp: number;
     };
@@ -59,14 +58,14 @@ export interface OrchestrationEvents {
         previousStatus?: NodeStatus;
         durationMs?: number;
         error?: string;
-        /** Per-node token spend for the completed node (BUDGET-03). */
+        /** Per-node token spend for the completed node. */
         tokensUsed?: number;
-        /** Per-node cost for the completed node (BUDGET-03). */
+        /** Per-node cost for the completed node. */
         cost?: number;
         timestamp: number;
     };
     /**
-     * A graph node's sub-agent exceeded its per-node token budget (BUDGET-03).
+     * A graph node's sub-agent exceeded its per-node token budget.
      * Counts/ids only — NEVER task text or output (AGENTS.md §2.7). Mirrors the
      * memory:consolidated minimal-payload convention.
      */
@@ -79,7 +78,7 @@ export interface OrchestrationEvents {
         /** The node's actual run token spend. */
         tokensUsed: number;
         /**
-         * IN-02: which resolution source produced the breached cap (D3 precedence) —
+         * Which resolution source produced the breached cap (in precedence order) —
          * the node's own `tokenBudget`, the operator default
          * `security.agentToAgent.tokenBudget`, or the graph-budget inherit-share. A
          * closed-union enum tag (counts/ids-only, safe under §2.7) so an operator can
@@ -89,16 +88,16 @@ export interface OrchestrationEvents {
         timestamp: number;
     };
     /**
-     * AUDIT-01 / TREE (v2.29 Phase 215): the per-capability authorization decision
+     * The per-capability authorization decision
      * (allow + deny) for a gated call, emitted at the single chokepoint
      * (rpc-dispatch.ts in-process; setup-capability-endpoint.ts socket). SEPARATE
-     * from `audit:event` (the durable AUDIT-02 trail) — this one bridges to the
+     * from `audit:event` (the durable audit trail) — this one bridges to the
      * trajectory (`capability.audited`) as the spawn-tree's per-node producer
-     * (Plan 03's TREE fold groups these by leaseId, beside subagent:budget_exceeded).
-     * One chokepoint emits BOTH. Content-free by construction (T-215-01):
+     * (the spawn-tree fold groups these by leaseId, beside subagent:budget_exceeded).
+     * One chokepoint emits BOTH. Content-free by construction:
      * ids/caps/tool-NAME/method/decision ONLY — NO args/body/param field, so a
-     * careless emit cannot leak the tool.invoke args/a body/a secret. Asymmetry
-     * (G1): in-process has NO lease → leaseId/parentLeaseId/tool ABSENT, rootRunId
+     * careless emit cannot leak the tool.invoke args/a body/a secret. Asymmetry:
+     * in-process has NO lease → leaseId/parentLeaseId/tool ABSENT, rootRunId
      * is the synthetic `root-session-<key>`; the socket carries the full real tuple.
      * `decision` is a closed string-literal union (AGENTS §2.8).
      */
@@ -117,16 +116,16 @@ export interface OrchestrationEvents {
         runId?: string;
         /** The tree-stable root (the real lease's rootRunId, or the synthetic in-process root). */
         rootRunId: string;
-        /** The real lease id (socket). ABSENT in-process — never fabricated (G1). */
+        /** The real lease id (socket). ABSENT in-process — never fabricated. */
         leaseId?: string;
         /** The parent lease id (socket, when present) — the spawn-tree parent edge. */
         parentLeaseId?: string;
     };
     /**
-     * STEER-01 (v2.27 P3, Phase 175): a running sub-agent was steered IN-FLIGHT —
+     * A running sub-agent was steered IN-FLIGHT —
      * a high-priority message injected at the child's next step boundary
-     * (transcript + progress preserved) instead of today's kill+respawn. Emitted
-     * DAEMON-SIDE at the inject site (Plan 02, subagent-handlers.ts /
+     * (transcript + progress preserved) instead of a kill+respawn. Emitted
+     * DAEMON-SIDE at the inject site (subagent-handlers.ts /
      * sub-agent-runner.ts), gated behind `security.agentToAgent.steerInject`.
      * Counts/ids/typed-enum ONLY — NEVER the steer message body (AGENTS.md §2.7);
      * the message text is the highest-risk leak and is intentionally absent.
@@ -145,7 +144,7 @@ export interface OrchestrationEvents {
         timestamp: number;
     };
     /**
-     * A transient sub-agent completion delivery failed and was retried (DELIVERY-02/03).
+     * A transient sub-agent completion delivery failed and was retried.
      * Counts/ids only — NEVER announcement text or the error string (AGENTS.md §2.7).
      * Mirrors subagent:budget_exceeded's counts/ids/typed-tag discipline.
      */
@@ -160,7 +159,7 @@ export interface OrchestrationEvents {
     };
     /**
      * A sub-agent completion delivery was dead-lettered after exhausting retries
-     * (transient) or immediately (permanent) (DELIVERY-02/03). Counts/ids only (§2.7) —
+     * (transient) or immediately (permanent). Counts/ids only (§2.7) —
      * NEVER announcement text or the error string.
      */
     "subagent:delivery_deadlettered": {
@@ -183,28 +182,28 @@ export interface OrchestrationEvents {
         nodesSkipped: number;
         cancelReason?: "timeout" | "budget" | "manual";
         timestamp: number;
-        /** 3.3: Aggregate cache read tokens across all graph nodes. */
+        /** Aggregate cache read tokens across all graph nodes. */
         graphCacheReadTokens?: number;
-        /** 3.3: Aggregate cache write tokens across all graph nodes. */
+        /** Aggregate cache write tokens across all graph nodes. */
         graphCacheWriteTokens?: number;
-        /** 3.3: Cache effectiveness ratio (reads / (reads + writes)). */
+        /** Cache effectiveness ratio (reads / (reads + writes)). */
         graphCacheEffectiveness?: number;
-        /** 3.3: Per-node cache effectiveness breakdown. */
+        /** Per-node cache effectiveness breakdown. */
         nodeEffectiveness?: Record<string, number>;
         /**
-         * IN-01: per-node token-spend breakdown (nodeId → tokens) for the run,
+         * Per-node token-spend breakdown (nodeId → tokens) for the run,
          * sourced from the coordinator's nodeTokenSpend map. Present only when at
          * least one node recorded spend — the production reader of nodeTokenSpend
          * (otherwise a dead write). Counts/ids-only (§2.7). Mirrors nodeEffectiveness.
          */
         nodeTokenSpend?: Record<string, number>;
         /**
-         * COST-02: per-node CUMULATIVE corrected-$ cost ledger (nodeId → dollars)
+         * Per-node CUMULATIVE corrected-$ cost ledger (nodeId → dollars)
          * for the run, sourced from the coordinator's nodeCost map (each node's
          * summed event.cost — the same corrected dollars feeding the graph-wide
          * total). The subtree rollup (computeSubtreeCost) derives a node + its
          * descendants from this. Present only when at least one node recorded cost.
-         * Content-free (nodeId → number); the WEBUI-03 billing view consumes it.
+         * Content-free (nodeId → number); the web-UI billing view consumes it.
          */
         nodeCost?: Record<string, number>;
     };
@@ -216,8 +215,8 @@ export interface OrchestrationEvents {
         phase: "initialized" | "progress" | "completed" | "partial_complete" | "failed" | "aborted";
     };
     /**
-     * P1/TELEM-01: a `pipeline` tool invocation was authored — counts-only.
-     * Emitted DAEMON-SIDE (the graph.define / graph.execute handlers, Plan 02)
+     * A `pipeline` tool invocation was authored — counts-only.
+     * Emitted DAEMON-SIDE (the graph.define / graph.execute handlers)
      * where schema validity is determined (the buildGraphInput parse + validate)
      * and the resolved capabilityClass arrives. Mirrors the
      * memory:generation_quality triple (event -> health_signal row -> fleet
@@ -225,29 +224,29 @@ export interface OrchestrationEvents {
      * a secret (AGENTS.md §2.7) — closed enums + booleans only; every payload is
      * reconstructable from the bus alone.
      *
-     * `repaired` is ALWAYS false at P1: the repair producer is Phase 174 /
-     * AUTHOR-01 (the graph-helpers.ts fail-closed weak-model throw, UNWIRED here).
-     * The field exists so the SAME event is unchanged when P2 lands.
+     * `repaired` is ALWAYS false at this emit site: the conservative-repair
+     * producer (the graph-helpers.ts repair path) signals via the dedicated
+     * `graph:repaired` event instead of flipping this flag.
      */
     "pipeline:authored": {
         /** The pipeline action authored (closed union — define | execute). */
         action: "define" | "execute";
-        /** The calling model's resolved tier; "unknown" when the tier cannot be resolved (Pitfall 2 — record honestly, never silently drop). */
+        /** The calling model's resolved tier; "unknown" when the tier cannot be resolved (record honestly, never silently drop). */
         capabilityClass: "frontier" | "mid" | "small" | "nano" | "unknown";
         /** Did the call parse + validate against the graph schema (buildGraphInput)? */
         schemaValid: boolean;
-        /** P1: ALWAYS false (the repair producer is deferred to Phase 174 / AUTHOR-01). */
+        /** ALWAYS false here — a conservative repair is signalled via `graph:repaired` instead. */
         repaired: boolean;
         agentId?: string;
         sessionKey?: string;
         timestamp: number;
     };
     /**
-     * AUTHOR-01 (v2.27 P2, Phase 174): a weak-model + schema-invalid pipeline graph
+     * A weak-model + schema-invalid pipeline graph
      * was conservatively REPAIRED to a canonical template (deterministic
      * template-match + fillDagTemplate). Emitted DAEMON-SIDE (the graph-helpers.ts
-     * repair path, Plan 03) — the producer the P1 `pipeline:authored.repaired` flag
-     * documented as deferred. Counts/ids/enums ONLY — NEVER the graph body, task
+     * repair path) — the dedicated repair signal beside the counts-only
+     * `pipeline:authored`. Counts/ids/enums ONLY — NEVER the graph body, task
      * text, type_config value, or a secret (AGENTS.md §2.7). `pattern` is the matched
      * canonical template (closed enum); the repaired graph then flows through the
      * SAME governance as a hand-authored one. Every payload is reconstructable from
@@ -265,9 +264,9 @@ export interface OrchestrationEvents {
         timestamp: number;
     };
     /**
-     * AUTHOR-02 (v2.27 P2, Phase 174): a graph was SYNTHESIZED from a one-line intent
+     * A graph was SYNTHESIZED from a one-line intent
      * via the `from_intent` action (deterministic canonical-template expansion).
-     * Emitted DAEMON-SIDE (Plan 04). Counts/ids/enums ONLY — NEVER the intent text,
+     * Emitted DAEMON-SIDE. Counts/ids/enums ONLY — NEVER the intent text,
      * agent names, or task bodies (AGENTS.md §2.7); the intent text is the highest-risk
      * leak and is intentionally absent. The synthesized graph flows through the SAME
      * governance as a hand-authored one (it is never executed directly).
@@ -282,11 +281,11 @@ export interface OrchestrationEvents {
         timestamp: number;
     };
     /**
-     * FLEET-03 (v2.30 Phase 220): a durable run did NOT resume after a restart —
+     * A durable run did NOT resume after a restart —
      * the boot/watchdog resume pass orphaned it (durable-resume-engine.ts orphan()).
      * Emitted DAEMON-SIDE; bridges to a content-free `health_signal` obs row
      * (obs-autonomy-rows.ts) so `comis fleet` surfaces an orphaned-run count.
-     * Content-free by construction (T-220-01): the `reason` is a CLOSED enum —
+     * Content-free by construction: the `reason` is a CLOSED enum —
      * the engine's free-text reason ("not resumable: status=…", "reread failed",
      * "invalid caps", "resume failed") is mapped to a member via the TOTAL
      * `orphanReasonToEnum` BEFORE the emit and stays ONLY on the WARN log / notify.
@@ -299,7 +298,7 @@ export interface OrchestrationEvents {
         timestamp: number;
     };
     /**
-     * FLEET-03: a durable run resumed in-flight after a restart (the resume pass
+     * A durable run resumed in-flight after a restart (the resume pass
      * rehydrated it from its checkpoint). Counts/ids only (§2.7) — the numeric
      * stepIndex is the resumed checkpoint position, never a body.
      */
@@ -309,9 +308,9 @@ export interface OrchestrationEvents {
         timestamp: number;
     };
     /**
-     * FLEET-03: a capability lease (or a whole spawn tree) was cooperatively
+     * A capability lease (or a whole spawn tree) was cooperatively
      * REVOKED (lease.revoke). Carries the revoked COUNT + the rootRunId (an id) +
-     * timestamp ONLY — NEVER the lease bearer, selector, or any body (T-220-02).
+     * timestamp ONLY — NEVER the lease bearer, selector, or any body.
      */
     "autonomy:revoked": {
         rootRunId: string;
@@ -319,10 +318,30 @@ export interface OrchestrationEvents {
         timestamp: number;
     };
     /**
-     * FLEET-03: a spawn tree was HARD-killed (run.kill). DISTINCT from revoke —
+     * A per-root `autonomy.budget` limb crossed its warn threshold (80% of the
+     * cap) — the PRE-TRIP signal, fired once per (root, limb) so an operator sees
+     * a session approaching its budget BEFORE the abort wedges it. Counts + the
+     * closed limb/unit labels + the rootRunId ONLY.
+     */
+    "autonomy:budget_warning": {
+        rootRunId: string;
+        /** The warning limb: `tokens` | `wallClockMs` | `aggregateUsd`. */
+        limb: string;
+        /** The limb's running total, in `unit`. */
+        spent: number;
+        /** The limb's configured cap, in `unit`. */
+        cap: number;
+        /** The unit of `spent`/`cap`: `tokens` | `ms` | `usd`. */
+        unit: string;
+        /** spent/cap at emit time (≥ the 0.8 warn threshold). */
+        fraction: number;
+        timestamp: number;
+    };
+    /**
+     * A spawn tree was HARD-killed (run.kill). DISTINCT from revoke —
      * kill flips durable status to 'revoked' INDISTINGUISHABLY from a cooperative
      * revoke in the table, so the separate EVENT is the only way to count killed
-     * separately (RESEARCH OQ1). Carries the killed COUNT + rootRunId + timestamp ONLY.
+     * separately. Carries the killed COUNT + rootRunId + timestamp ONLY.
      */
     "autonomy:killed": {
         rootRunId: string;
@@ -330,15 +349,15 @@ export interface OrchestrationEvents {
         timestamp: number;
     };
     /**
-     * FLEET-02 (Phase 220-05): a Phase-217 capability-DENIAL breaker tripped — N
+     * A capability-DENIAL breaker tripped — N
      * consecutive floor-blocks aborted + killed the run tree (rpc-dispatch.ts, beside
      * the `execution:aborted{reason:"denial_breaker"}` emit). DISTINCT from both the
      * TOOL-failure breaker (`execution:aborted{reason:"circuit_breaker"}` → the
      * session-rollup `breakerTripCount` → `breakerTripTotal`) and from kill/revoke:
      * the denial-breaker abort is NEVER a session endReason and NEVER a
      * breakerTripCount, so this dedicated event is the ONLY fleet-ingestion path for
-     * it — without it the trip is invisible to `comis fleet` (the milestone-audit
-     * FLEET-02 gap; the aborted run lands in durable status 'completed', so it shows
+     * it — without it the trip is invisible to `comis fleet` (the aborted run lands
+     * in durable status 'completed', so it shows
      * 0 in orphaned/revoked/killed/breakerTrips too). Carries the rootRunId (an id) +
      * timestamp ONLY — NEVER the engine's free-text deny reason (which stays on the
      * escalate/WARN at the source). Each trip is one event (the count is the row count).
@@ -347,4 +366,75 @@ export interface OrchestrationEvents {
         rootRunId: string;
         timestamp: number;
     };
+    /**
+     * A completed `orchestrate` run — the content-free per-run summary
+     * every `comis explain` / `comis fleet` consumer reads. Emitted from the
+     * `orchestrate` TOOL (agent-side, where the threaded eventBus reaches the live
+     * per-session trajectory bridge), NOT a daemon graph handler — the per-session
+     * recordEvent on the graph-handler deps is a permanent no-op. Timing is safe:
+     * the bridge attaches at execute() START; this fires at run COMPLETION.
+     *
+     * Content-free by construction (AGENTS §2.7): ids + closed enums + counts +
+     * token ESTIMATES + a bounded cap-mapped tool-NAME sequence only. `failureClass` is a CLOSED union — the free-text
+     * failure reason (stderr tail, thrown message) is mapped to a member BEFORE the
+     * emit and stays ONLY on the bounded tool-error surface (the runner's
+     * STDERR_TAIL_MAX_CHARS tail), NEVER on the bus. The bus never carries the
+     * stderr tail, the script body, or the tool params.
+     *
+     * Self-attributing: `rootRunId` + `sessionKey` ride the payload so a
+     * daemon-shared-bus event lands on the right session's report (the
+     * `capability:audited` precedent) — never inferred from ambient state. The
+     * per-run child `leaseId` (absent only when no lease was minted) is the
+     * unforgeable per-run correlator every downstream fold groups on.
+     */
+    "orchestrate:run_summary": {
+        /** The runner's per-run id (`orch-<ts36>-<rand>`). */
+        runId: string;
+        /** The per-run child leaseId — the per-run correlator. Absent only if no lease was minted. */
+        leaseId?: string;
+        /** The tree-stable root the run's lease inherits — an attribution key (the bus fans out to every session bridge). */
+        rootRunId: string;
+        /** The owning session — an attribution key. Absent for a heartbeat/cron run with no session. */
+        sessionKey?: string;
+        /**
+         * The owning TURN's trace correlator — distinct from `runId`/`rootRunId`
+         * (the orchestrate-RUN ids). Carried so the learning ledger keys the
+         * descriptor row on the turn trajectory. Content-free: a UUID correlator, the
+         * same class as `rootRunId`/`sessionKey`. Absent outside a request scope.
+         */
+        traceId?: string;
+        /** The script language (mirrors the orchestrate `language` param). */
+        language: "ts" | "js" | "py";
+        /** Wall-clock duration of the run (ms). */
+        durationMs: number;
+        /** The jailed child's process exit code (0 on success; the real code on a non-zero exit; a sentinel on kill/spawn-fail). */
+        exitCode: number;
+        /**
+         * CLOSED enum — the run's degradation class, or ABSENT on a clean run. NOT
+         * the engine's free text (a stderr tail / thrown message is mapped to a
+         * member before emit and stays on the tool-error surface).
+         */
+        failureClass?: "timeout" | "stdout_cap" | "nonzero_exit" | "spawn_fail" | "lease_absent";
+        /** Pre-bounce raw stdout byte length. */
+        stdoutBytesRaw: number;
+        /** POST-bounce stdout char count — the tokens that actually re-entered context (the SAVE-01 actual). */
+        stdoutCharsReentered: number;
+        /** Count of materialized ResultRef files the run produced. */
+        resultRefCount: number;
+        /** Total bytes of those materialized ResultRefs (the counterfactual input). */
+        resultRefBytes: number;
+        /** The labeled counterfactual token-savings ESTIMATE (materialized-bytes/4 − post-bounce/4). */
+        estSavedTokens?: number;
+        /** estSavedTokens / wouldBeTokens in [0,1]; absent/0 when nothing was materialized. */
+        savedRatio?: number;
+        /**
+         * The run's bounded, content-free declared tool-NAME ORDERED call-site
+         * sequence + counts from the pre-flight footprint — cap-mapped identifiers,
+         * repeats = per-method counts, source-order, capped. Absent on a run with no
+         * cap-mapped call sites. Like `capability:audited`'s `tool`, the NAMES are
+         * safe; NEVER args/values/bodies.
+         */
+        toolSequence?: readonly string[];
+        timestamp: number;
+    };
 }

package/node_modules/@comis/core/dist/event-bus/events-terminal.d.ts

@@ -1,23 +1,23 @@
 /**
  * TerminalEvents: interactive terminal-driver lifecycle events (terminal:*).
  *
- * P0/OPS-07 emits a state-transition event and a spawn-failure event. P4
- * (Phase 123, SEC-10/OPS-06) makes the keystroke + eviction audit surface LIVE
- * with two more: `terminal:keystroke` (every send_text/send_key) and
- * `terminal:session_evicted` (the reaper / cap-trip signal). P5 (Phase 124,
- * TR-11/OPS-04/SEC-11/SEC-12) adds the attention + audit set: `terminal:input_needed`
+ * The driver emits a state-transition event and a spawn-failure event. The
+ * keystroke + eviction audit surface adds
+ * two more: `terminal:keystroke` (every send_text/send_key) and
+ * `terminal:session_evicted` (the reaper / cap-trip signal). The attention +
+ * audit set covers `terminal:input_needed`
  * (the agent-wake signal), `terminal:stuck` (settled, no progress), `terminal:escalated`
  * (an auto-answer escalation / hop-limit / loop audit), and `terminal:auto_answered`
- * (a safe-pattern answer was sent). Phase 164 (DRIVE-02, v2.24) adds the autonomous-drive
- * promotion signal `terminal:drive_promoted` (a long drive crossed the inline→detached
+ * (a safe-pattern answer was sent). The autonomous-drive
+ * promotion signal `terminal:drive_promoted` fires when a long drive crossed the inline→detached
  * threshold — the skills wait tool emits it, the daemon wake dispatcher consumes it to
- * fire ONE "drive started (backgrounded)" notification). Phase 165 (DUR-01, v2.24) adds the
- * durability RE-ATTACH signal `terminal:drive_reattached` (on a daemon restart the session
- * registry recovered a durable drive whose detached tmux server SURVIVED + re-attached it as
- * `running` instead of `lost` — the daemon emits it so a 40h drive's restart is reconstructable
- * via `comis explain`, design §9); the genuinely-gone path REUSES the existing
+ * fire ONE "drive started (backgrounded)" notification. The
+ * durability RE-ATTACH signal `terminal:drive_reattached` fires when on a daemon restart the
+ * session registry recovered a durable drive whose detached tmux server SURVIVED + re-attached it
+ * as `running` instead of `lost` — the daemon emits it so a 40h drive's restart is reconstructable
+ * via `comis explain`; the genuinely-gone path REUSES the existing
  * `terminal:session_state(state:"lost")` (there is NO `failed` member — the user-facing `failed`
- * OUTCOME is Phase 166 NOTIFY-01's, derived from lost + a durable journal + an unrecoverable
+ * OUTCOME is derived downstream from lost + a durable journal + an unrecoverable
  * reason). Every payload carries `sessionId` + `agentId` + `timestamp` so a transition is
  * reconstructable from the bus alone (AGENTS.md §2.7).
  *
@@ -35,26 +35,26 @@ export interface TerminalEvents {
         agentId: string;
         state: "created" | "running" | "exited" | "lost";
         /**
-         * CR-01 (Phase 166): the GENUINE-DEATH discriminator for a `lost` transition. `lost`
+         * The GENUINE-DEATH discriminator for a `lost` transition. `lost`
          * has TWO indistinguishable-on-the-bus sources: a genuinely unrecoverable death
          * (terminal-durable-wiring.ts `onUnrecoverable` — the durable tmux is truly gone on
-         * recover-on-boot; the ONLY I9-legitimate user-facing `failed`) and a TRANSIENT
+         * recover-on-boot; the ONLY legitimate source of a user-facing `failed`) and a TRANSIENT
          * worker-process crash that respawns (terminal-worker-supervisor.ts → the fd3 re-publish;
          * the supervisor's own hint says "worker will re-spawn") or a durable session that
-         * re-attaches (I10). Set `true` ONLY at the genuine-death emit; ABSENT on a
+         * re-attaches. Set `true` ONLY at the genuine-death emit; ABSENT on a
          * transient/recoverable `lost` (a worker-crash respawn or the reaper's plain lost). The
-         * NOTIFY-01 wake holder maps `lost` → `failed` ONLY when this is `true` — otherwise it
-         * reclaims in-memory state with NO `failed` notification (the I9/I10 invariant). A boolean
-         * flag, content-free (I3).
+         * wake holder maps `lost` → `failed` ONLY when this is `true` — otherwise it
+         * reclaims in-memory state with NO `failed` notification (a recoverable lost must never
+         * surface as a user-facing failure). A boolean flag, content-free.
          */
         unrecoverable?: boolean;
         /**
-         * CR-01 / WR-03 (Phase 166): the content-free unrecoverable reason (a SHORT structural
+         * The content-free unrecoverable reason (a SHORT structural
          * tag, e.g. `"tmux_session_gone"`) carried ONLY on a genuine-death `lost` (paired with
-         * `unrecoverable:true`) so NOTIFY-01 / `comis explain` can name the actual cause on the
+         * `unrecoverable:true`) so the wake holder / `comis explain` can name the actual cause on the
          * `failed` outcome + the §2.7 WARN, rather than a generic "session_lost". A machine tag,
          * NEVER screen text / keystrokes / command output (the redacted detail rides the structured
-         * LOG, never the bus — I3).
+         * LOG, never the bus).
          */
         reason?: string;
         /**
@@ -121,9 +121,9 @@ export interface TerminalEvents {
         timestamp: number;
     };
     /**
-     * Attention wake (TR-11): the classifier settled the grid to a state that
+     * Attention wake: the classifier settled the grid to a state that
      * needs the agent — the cursor is parked at a plausible input position
-     * (`awaiting-input`) or the session is `stuck`. The dispatcher (124-07) turns
+     * (`awaiting-input`) or the session is `stuck`. The dispatcher turns
      * this into AT MOST ONE woken turn per unanswered frame. Carries a typed
      * `state` + a SHORT STRUCTURAL `reason` tag (e.g. `"settled_cursor_parked"`)
      * — NEVER screen text. The screen contents that drove the classification ride
@@ -136,16 +136,16 @@ export interface TerminalEvents {
         /** A short structural classification tag (e.g. "settled_cursor_parked") — NEVER screen text. */
         reason: string;
         /**
-         * Classifier confidence (CLASS-02) — `high` for the structural certainties
+         * Classifier confidence — `high` for the structural certainties
          * (cursor parked at a prompt), `medium` for the heuristics (e.g. `dialog_detected`).
-         * A 2-value enum, content-free: it rides the wake event for the autonomous policy
-         * (164–166) + a future `comis explain`. The screen that drove it rides the LOG.
+         * A 2-value enum, content-free: it rides the wake event for the autonomous
+         * policy. The screen that drove it rides the LOG.
          */
         confidence: "high" | "medium";
         timestamp: number;
     };
     /**
-     * Stuck signal (OPS-04): the session settled with no affordance and made no
+     * Stuck signal: the session settled with no affordance and made no
      * progress for longer than the operator `stuckMs`. A DURATION signal, not
      * content — `noProgressMs` is the elapsed no-progress window, nothing about
      * what is (or is not) on screen.
@@ -157,16 +157,16 @@ export interface TerminalEvents {
         noProgressMs: number;
         /**
          * The classifier's structural reason tag (e.g. "no_progress") — surface-only for
-         * observability symmetry with `terminal:input_needed` (CLASS-02; RESEARCH Open Q3).
-         * A machine tag, NEVER screen text; the FSM does NOT branch on it in 163.
+         * observability symmetry with `terminal:input_needed`.
+         * A machine tag, NEVER screen text; the wake FSM does NOT branch on it.
          */
         reason: string;
-        /** Classifier confidence (CLASS-02) — a 2-value enum, content-free (see input_needed). */
+        /** Classifier confidence — a 2-value enum, content-free (see input_needed). */
         confidence: "high" | "medium";
         timestamp: number;
     };
     /**
-     * Escalation audit (SEC-11/SEC-12): the auto-answer policy or a guard escalated
+     * Escalation audit: the auto-answer policy or a guard escalated
      * to a human instead of acting — a destructive/approval/auth-login prompt, a
      * detected loop, the dispatcher hop limit, a stuck session, or a frame that
      * matched no safe pattern. Carries a typed closed `reason` ONLY (the audited
@@ -179,7 +179,7 @@ export interface TerminalEvents {
         timestamp: number;
     };
     /**
-     * Auto-answer audit (SEC-12): a safe-pattern answer was sent. Carries the
+     * Auto-answer audit: a safe-pattern answer was sent. Carries the
      * matched operator-pattern INDEX + the count of keystrokes sent — NEVER the
      * keystroke itself (mirrors `terminal:keystroke`'s redaction-safe summary). The
      * redacted keystroke detail rides the structured LOG, never the bus.
@@ -190,7 +190,7 @@ export interface TerminalEvents {
         /** Index of the matched safe affordance (a hintPattern OR a profile dialog — see `source`) — an id, not the prompt. */
         matchedPatternIndex: number;
         /** WHICH allowlist authorized the keystroke: `"hint"` (operator hintPattern) or `"dialog"` (the
-         *  selected platform profile's safe dialog, v2.26 DIALOG-01) — the audit provenance for a
+         *  selected platform profile's safe dialog) — the audit provenance for a
          *  security-sensitive auto-answer; content-free. Absent on the worker fd3-republish path. */
         source?: "hint" | "dialog";
         /** Count of keystrokes the canned answer sent — a size signal, not the content. */
@@ -198,16 +198,16 @@ export interface TerminalEvents {
         timestamp: number;
     };
     /**
-     * Autonomous-drive promotion (DRIVE-02, Phase 164, v2.24): a backgrounded-capable
+     * Autonomous-drive promotion: a backgrounded-capable
      * drive crossed the inline→detached threshold. The skills wait tool (Context A,
-     * the agent's LLM turn) consults the pure `shouldPromoteDrive` predicate (164-02) on
+     * the agent's LLM turn) consults the pure `shouldPromoteDrive` predicate on
      * its `WaitResult` and, on a qualifying wait, emits this event; the fd3 wake dispatcher
      * (Context B, the daemon) consumes it into a closure-local promoted-Set and fires
      * EXACTLY ONE "drive started (backgrounded)" notification (promote-once — the skills
      * tool emits per-qualifying-wait, the daemon collapses to one). A sub-threshold inline
-     * drive (a `git status` one-shot) emits nothing (I1).
+     * drive (a `git status` one-shot) emits nothing.
      *
-     * CONTENT-FREE (I3): carries `sessionId`/`agentId` + a typed `reason` enum (the WHY it
+     * CONTENT-FREE: carries `sessionId`/`agentId` + a typed `reason` enum (the WHY it
      * promoted) + `timestamp` ONLY — NEVER the screen, command output, or a secret. The
      * screen digest that drove the wait rides the structured LOG, never the bus.
      */
@@ -215,7 +215,7 @@ export interface TerminalEvents {
         sessionId: string;
         agentId: string;
         /**
-         * Why the drive promoted (a closed enum, NEVER screen text — I3):
+         * Why the drive promoted (a closed enum, NEVER screen text):
          * `producing` = the honest `isComplete:false,producing:true` settle signal under
          * `mode:"auto"` (the program is still working); `mode_detached` = the operator set
          * `drive.mode:"detached"` (promote-at-first-wait, an explicit opt-in).
@@ -224,34 +224,34 @@ export interface TerminalEvents {
         timestamp: number;
     };
     /**
-     * Autonomous-drive RE-ATTACH (DUR-01, Phase 165, v2.24): on a daemon restart the session
+     * Autonomous-drive RE-ATTACH: on a daemon restart the session
      * registry recovered a persisted descriptor whose detached tmux server SURVIVED and
-     * re-attached the drive as `running` (NOT `lost`) WITHOUT a second create frame (I10 — the
+     * re-attached the drive as `running` (NOT `lost`) WITHOUT a second create frame (the
      * worker's `has-session`-gated backend re-attaches the surviving pane on the next read). The
      * registry's `onReattached` hook (injected, infra-decoupled) drives this so a 40h drive's
-     * restart/re-attach is reconstructable via `comis explain` (design §9). MIRRORS
-     * {@link TerminalEvents}["terminal:drive_promoted"]'s content-free shape (the 164 precedent).
+     * restart/re-attach is reconstructable via `comis explain`. MIRRORS
+     * {@link TerminalEvents}["terminal:drive_promoted"]'s content-free shape.
      *
      * The genuinely-gone counterpart is NOT a new event: it REUSES the existing
      * `terminal:session_state(state:"lost")` + a content-free unrecoverable reason on the
      * structured LOG. There is NO `state:"failed"` member (the union is
-     * created|running|exited|lost); the user-facing `failed` OUTCOME is Phase 166 NOTIFY-01's,
+     * created|running|exited|lost); the user-facing `failed` OUTCOME is
      * derived downstream from (`lost` + a durable drive journal + the unrecoverable reason).
      *
-     * CONTENT-FREE (I3): sessionId / agentId + a single-member `reason` enum (the WHY it
+     * CONTENT-FREE: sessionId / agentId + a single-member `reason` enum (the WHY it
      * re-attached, NEVER the screen) / timestamp ONLY. The screen the drive resumed on rides the
      * detached tmux session, never the bus.
      *
-     * OBSERVABILITY NOTE (165-REVIEW ME-01): this event can fire DURING the daemon's boot sweep
+     * OBSERVABILITY NOTE: this event can fire DURING the daemon's boot sweep
      * BEFORE the wake-FSM subscribes (the recover-on-boot race), and it is NOT in observability's
-     * TRAJECTORY_BRIDGE_MAPPING — so the AUTHORITATIVE §9 boot re-attach record an operator
+     * TRAJECTORY_BRIDGE_MAPPING — so the AUTHORITATIVE boot re-attach record an operator
      * reconstructs via `comis explain` is the INFO log at the emit site
      * (`terminal-durable-wiring.ts`'s onReattached), which survives regardless of any subscriber.
      */
     "terminal:drive_reattached": {
         sessionId: string;
         agentId: string;
-        /** Why the drive re-attached (a closed enum, NEVER screen text — I3): `tmux_alive` = the persisted descriptor's `comis-<id>` tmux server survived the restart, so it re-attached instead of being flipped `lost`. */
+        /** Why the drive re-attached (a closed enum, NEVER screen text): `tmux_alive` = the persisted descriptor's `comis-<id>` tmux server survived the restart, so it re-attached instead of being flipped `lost`. */
         reason: "tmux_alive";
         timestamp: number;
     };