peaks-loop 4.1.1 → 4.1.2

package/dist/services/skills/skill-presence-service.js

@@ -25,7 +25,6 @@ export const VALID_SKILL_PRESENCE_MODES = [
     'strict',
     '24h'
 ];
-// Migration note (slice 2026-09-09-mode-consolidation): `swarm` was REMOVED
 // as a mode — parallel fan-out is now the default execution strategy in
 // every mode. A legacy on-disk `mode: 'swarm'` is normalized on read to
 // `'full-auto'` (never crash, never drop the presence).
@@ -105,7 +104,6 @@ function resolveProjectRoot(override) {
  * to auto-resolve `--session-id` when the LLM driver forgets to
  * pass the flag, so dispatch records land in the right
  * `.peaks/_sub_agents/<sid>/` tree instead of an `unknown-sid`
- * fallback (slice 2026-06-26-unknown-sid-fallback-fix).
  */
 export function getCurrentSessionId(projectRootOverride) {
     const projectRoot = resolveProjectRoot(projectRootOverride);
@@ -161,7 +159,6 @@ function readSkillPresenceFromLease(projectRootOverride) {
     // not the legacy `outerSessionId` field. Project it for back-compat
     // with `clearStalePresenceOnRotation`'s outer-mismatch check.
     //
-    // Slice 2026-09-09-mode-consolidation: `mode` is projected too (it was
     // silently dropped before, which made `getSkillPresence().mode` always
     // undefined and left every `presence.mode` consumer dead). Normalize on
     // read so a legacy `'swarm'` lease surfaces as `'full-auto'`.
@@ -206,12 +203,10 @@ function getBoundOuterSessionId(projectRootOverride) {
  * are about to stamp, the user probably closed the previous outer
  * session and is now driving peaks from a new one.
  *
- * As of slice 018 (auto-roll on outer-mismatch), the actual rotation
  * is `ensureSessionWithRotation`'s job, not this one. The presence
  * service still emits the structured `outerSessionMismatch` field on
  * the presence envelope (useful for the statusline to render a stale
  * marker and for the QA / log consumers to know an outer-session swap
- * happened), but it no longer carries the implicit "ask the user"
  * promise — `peaks-code`'s Step 0 no longer needs to surface an
  * AskUserQuestion, because the rotation already fired by the time the
  * skill is invoked.
@@ -232,12 +227,10 @@ function getPreviousOuterSessionId(projectRootOverride) {
     return undefined;
 }
 // ============================================================================
-// Slice 020 — caller-keyed active-skill marker (D6).
 // ============================================================================
 //
 // Today's per-project active-skill marker (`.peaks/_runtime/active-skill.json`)
 // races when multiple Claude Code windows (or different platforms) drive the
-// same project concurrently. Slice 020 introduces a per-caller file at
 // `.peaks/_runtime/<peakSid>/active-skill-<callerId>.json` (D6). Two callers
 // bound to the same peak session never clobber each other.
 //
@@ -311,7 +304,6 @@ export function setSkillPresence(skill, mode, gate, projectRootOverride) {
     const outerSessionId = getCurrentOuterSessionId();
     const previousOuterSessionId = getPreviousOuterSessionId(projectRootOverride);
     const now = new Date().toISOString();
-    // v2.15.0 slice 002 repair: always write `outerSessionId` (even
     // as `''`) when no harness env var is set. Without this, the JSON
     // envelope omits the key entirely, which makes downstream staleness
     // detection unreliable (consumers can't tell "no signal" from
@@ -368,7 +360,6 @@ export function setSkillPresence(skill, mode, gate, projectRootOverride) {
                     import('./presence-lease-service.js')
                 ]);
                 const projection = resolveCallerProjection({ projectRoot, env: process.env });
-                // Slice 2026-08-06-session-cacde8-A.4: derive the legacy compat
                 // shim's workflowId from `projection.callerId` (caller-keyed,
                 // matching the 4.0.8 caller-binding direction) instead of
                 // `sessionId` (sid-keyed, pre-4.0.8). `slice(0, 189)` caps the
@@ -479,8 +470,6 @@ export function checkStalePresence(opts) {
     };
 }
 /**
- * Slice 002 (v2.15.0) — auto-clear stale presence on session
- * rotation (AC-1).
  *
  * Called from `peaks workspace init` immediately after a successful
  * `outer-session-mismatch` rotation. When the previous session's
@@ -488,7 +477,6 @@ export function checkStalePresence(opts) {
  * clearing it prevents peaks-code Step 1 from picking up a stale
  * `mode` field that the user never explicitly chose.
  *
- * Slice rid-skill-persistence-001 (2026-08-12): added an outerSessionId
  * intent-source guard at the top of the function. The user constraint
  * (preserved in `.peaks/memory/2026-08-11-peaks-code-skill-persistence-pause.md`)
  * requires that "the current bee (peaks-code) can only be replaced or
@@ -525,7 +513,6 @@ export function checkStalePresence(opts) {
  * decide what the "rotated-out" id was.
  */
 export function clearStalePresenceOnRotation(opts) {
-    // Slice rid-skill-persistence-001 (2026-08-12): user-explicit intent
     // guard. When the caller has no caller-binding outerSessionId
     // (env vars unset, system-triggered rotation), refuse the mutation
     // up-front — the recorded presence may belong to a user-explicit

package/dist/services/skills/skill-statusline-model.d.ts

@@ -42,7 +42,6 @@ export type StatusLineModel = {
     compact: CompactStatuslineState;
     activeLeaf: StatusLineActiveLeaf | null;
     /**
-     * Slice 2026-08-05-statusline-sid-only-marker: the canonical session
      * id resolved for the project root (`getSessionIdCanonical`), or
      * `null` when no project root is bound or no `.peaks/_runtime/<sid>/`
      * session is on disk. The renderer reads this to append ` [shortSid]`
@@ -56,7 +55,6 @@ export type StatusLineModel = {
      */
     sessionId: string | null;
     /**
-     * Slice rid-statusline-24h-overlay (2026-08-10): the 24h-mode
      * overlay snapshot read from `.peaks/_runtime/<sid>/24h-state.json`,
      * or `null` when no file exists / file is corrupt / file has wrong
      * shape. The renderer reads this to append `[24h-<state>]` after
@@ -68,25 +66,21 @@ export type StatusLineModel = {
     twentyFourHourState: TwentyFourHourOverlay | null;
 };
 /**
- * Slice rid-statusline-24h-overlay (2026-08-10): minimal overlay
  * type returned by `read24hOverlay`. The renderer only consumes
  * `state` (to format `[24h-<state.toLowerCase()>]`). The canonical
  * schema at `src/services/24h-mode/state.ts:55-66` carries additional
  * fields (`attempts: Record<DecisionKey, number>`, `enteredAt`,
  * `checkpoints`, etc.) but the overlay is deliberately MINIMAL —
  * it tolerates forward compatibility with new states the writer
- * may add, and it never throws on malformed shapes (PRD AC-3:
  * graceful null on any invalid input).
  */
 export type TwentyFourHourOverlay = {
     state: string;
 };
 /**
- * Slice rid-statusline-24h-overlay (2026-08-10): name-distinct from
  * the canonical `read24hState` in `src/services/24h-mode/store.ts:108`.
  * The canonical reader calls `coerceSnapshot` (which throws on
  * malformed shapes via `24H_STATE_INVALID`); this overlay reader
- * returns `null` for ANY malformed shape (per PRD AC-3 — never
  * throw across the statusline boundary).
  *
  * Returns null when:

package/dist/services/skills/skill-statusline-model.js

@@ -13,11 +13,9 @@ import { decideCompactStatusline } from '../compact-statusline/compact-statuslin
 import { getSessionIdCanonical } from '../session/session-manager.js';
 import { readActiveDispatchIndex } from '../dispatch/dispatch-record-writer.js';
 /**
- * Slice rid-statusline-24h-overlay (2026-08-10): name-distinct from
  * the canonical `read24hState` in `src/services/24h-mode/store.ts:108`.
  * The canonical reader calls `coerceSnapshot` (which throws on
  * malformed shapes via `24H_STATE_INVALID`); this overlay reader
- * returns `null` for ANY malformed shape (per PRD AC-3 — never
  * throw across the statusline boundary).
  *
  * Returns null when:
@@ -44,7 +42,6 @@ export function read24hOverlay(projectRoot, sessionId) {
         parsed = JSON.parse(raw);
     }
     catch {
-        // corrupt JSON — graceful null (PRD AC-3)
         return null;
     }
     if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
@@ -125,7 +122,7 @@ export function readActiveLeaf(projectRoot, sessionId) {
         'never-started',
         'unreadable',
         'stale',
-        'queued' // Slice 2026-08-05 fix: stale dispatch entries stuck at 'queued' should
+        'queued'
         // not pollute statusline as in-flight leaves.
     ]);
     const inFlight = Object.values(index).filter((e) => !terminalStatuses.has(e.status));

package/dist/services/skills/skill-statusline-renderer.d.ts

@@ -20,7 +20,6 @@ export interface StatusLineRenderOptions {
 }
 export declare function formatHumanAge(ageMs: number | null): string;
 /**
- * Slice rid-statusline-24h-overlay (2026-08-10): format the 24h-mode
  * overlay suffix appended after the existing `<baseMode>` token in
  * the ACTIVE state. Returns `''` when the overlay is `null` (missing
  * file / corrupt file / wrong shape — see `read24hOverlay`).

package/dist/services/skills/skill-statusline-renderer.js

@@ -4,13 +4,11 @@ import { computeRootSuffix as computeRootSuffixImpl } from './skill-statusline-s
 // Re-export so existing test imports
 // (`import { formatShortSid, computeRootSuffix } from '.../skill-statusline-renderer'`)
 // keep working byte-identically after the helper extraction in slice
-// 2026-08-05-statusline-sid-only-marker-and-multi-binary-drift-guard
 // repair cycle.
 export { formatShortSid } from './skill-statusline-sid-suffix.js';
 export const computeRootSuffix = computeRootSuffixImpl;
 import { DEFAULT_CAPABILITY, HIGHLIGHT_SGR_OPEN, brandRun, brandText, isAttentionGate, paletteFor, renderActiveDot } from './statusline-palette.js';
 function formatAge(ageMs) {
-    // Slice rid-statusline-stale-ux AC-1: this legacy `stale <N>h/m`
     // token is NO LONGER used by renderStale. Kept exported / defined
     // for any downstream caller / test that still asserts against the
     // `stale` substring. The active renderer path uses `formatHumanAge`.
@@ -22,7 +20,6 @@ function formatAge(ageMs) {
     const minutes = Math.max(1, Math.round(ageMs / (60 * 1000)));
     return `stale ${minutes}m`;
 }
-// Slice rid-statusline-stale-ux AC-1 + perf H2: human-friendly neutral
 // age label for the stale branch. en-US strings per RD §5 R1 (codebase
 // consistency); zh-CN deferred to a future i18n slice. Backed by a
 // bounded Map cache (parity with `formatShortSid` memoization at
@@ -66,7 +63,6 @@ function rootLabel(projectRoot) {
     return basename(projectRoot);
 }
 /**
- * Slice rid-statusline-24h-overlay (2026-08-10): format the 24h-mode
  * overlay suffix appended after the existing `<baseMode>` token in
  * the ACTIVE state. Returns `''` when the overlay is `null` (missing
  * file / corrupt file / wrong shape — see `read24hOverlay`).
@@ -88,7 +84,6 @@ export function format24hSuffix(overlay, palette, capability, noColor) {
 /**
  * `formatShortSid` + `computeRootSuffix` were extracted to
  * `./skill-statusline-sid-suffix.ts` in the slice
- * 2026-08-05-statusline-sid-only-marker-and-multi-binary-drift-guard
  * repair cycle so the renderer file stays under the Karpathy
  * 800-line cap. Both helpers are re-exported above for back-compat
  * with existing test imports.
@@ -99,7 +94,6 @@ export function format24hSuffix(overlay, palette, capability, noColor) {
  * is obvious at the call site and so each state has a single
  * responsibility.
  *
- * Active-leaf rendering (slice 2026-08-04-rid-005-statusline-dual-skill):
  * when the model carries an `activeLeaf` (an in-flight bee dispatch under
  * the orchestrator), the line surfaces the leaf role alongside the
  * orchestrator skill. The render priorities are:
@@ -118,7 +112,6 @@ function renderActive(presence, palette, nowMs, capability, noColor, activeLeaf,
     if (!presence) {
         return `${palette.idle} ${palette.idleLabel}`;
     }
-    // Slice rid-statusline-24h-overlay (2026-08-10): the 24h suffix
     // is appended on every active-return branch that carries a skill
     // token. The `!presence` branch (idle mark, no skill token) is
     // intentionally NOT modified — 24h overlays are active-only.
@@ -145,7 +138,6 @@ function renderActive(presence, palette, nowMs, capability, noColor, activeLeaf,
     return `${dot} ${brandRun(skill, noColor, capability)}${modeToken}${suffix}`;
 }
 function renderStale(presence, ageMs, palette, capability, noColor) {
-    // Slice rid-statusline-stale-ux AC-1: stale presence belongs to a
     // *previous* session (outer-session-mismatch). Line still emits the
     // recorded skill name (per C-1 — `expect(out).toContain('peaks-code')`
     // must keep passing), but uses `palette.idleStale` (new muted palette,
@@ -208,7 +200,6 @@ function renderCompact(state, palette) {
                 ? `${palette.inlineSeparator}${formatRatio(state.triggerRatio)}`
                 : ''}`;
         case 'armed': {
-            // Slice 2026-09-12-compact-band-policy: NO bar. A bar is a
             // progress claim, and a registered-but-unfired trigger has no
             // progress to report — it is waiting for the ratio to reach the
             // red line on its own. Say exactly that instead.
@@ -506,8 +497,6 @@ export function renderStatusLine(model, options, env) {
     const palette = paletteFor(capability, noColor);
     const root = rootLabel(model.projectRoot);
     // short-sid suffix (slices
-    //   - 2026-08-05-statusline-empty-render-and-short-sid-suffix (active only)
-    //   - 2026-08-05-statusline-sid-only-marker (idle + stale also)
     // ):
     // the project root cell carries ` [shortSid]` after `peaks-loop` whenever
     // a canonical session id resolves. Per-state matrix:
@@ -534,7 +523,6 @@ export function renderStatusLine(model, options, env) {
     const compactSegment = renderCompact(model.compact, palette);
     let line;
     const hasCompact = compactSegment.length > 0;
-    // Slice 2026-09-12-compact-band-policy: `armed` is a RESTING state, not
     // an in-flight compact. It can hold for the whole band between the
     // auto-fire ratio and the red line, so it is appended to the normal
     // line instead of REPLACING the skill token — hiding which skill is

package/dist/services/skills/skill-statusline-service.js

@@ -21,7 +21,6 @@ export { parseStatusLineStdin, read24hOverlay } from './skill-statusline-model.j
  * skill-presence-service.ts, it never deletes or rewrites the presence file:
  * the statusLine runs on every turn and must have zero side effects.
  *
- * Slice 2026-08-05-statusline-sid-scoped-lease-B: the read no longer falls
  * back to the project-level `.peaks/_runtime/active-skill.json` (or its
  * legacy `.peaks/.active-skill.json`). The canonical lease projection is
  * the only source. When `callerId === null` (non-IDE caller), the read
@@ -35,7 +34,6 @@ const STALE_THRESHOLD_MS = 24 * 60 * 60 * 1000;
  * absent (idle) and a sentinel object for malformed content (invalid-presence).
  *
  * Both branches now route through the canonical sid-scoped lease projection
- * (slice 2026-08-05-statusline-sid-scoped-lease-B):
  *   - `callerId !== null` → `resolveActiveSkillForCaller` with the canonical
  *     (non-legacy) lease projection, filtered to this callerId. When the
  *     callerId-filtered resolution returns `source: 'none'` (no lease under
@@ -43,7 +41,6 @@ const STALE_THRESHOLD_MS = 24 * 60 * 60 * 1000;
  *     to the session's most-recent in-flight lease. AC4 multi-tenant isolation
  *     is preserved: when callerId A DOES have a lease, the first call returns
  *     it and the fallback never fires — callerId B's lease is never surfaced
- *     to callerId A. (Slice 2026-08-05-statusline-empty-render-and-short-sid-suffix.)
  *   - `callerId === null` → enumerate `listPresenceLeases` for the
  *     canonical session and pick the most recent in-flight lease. Back-compat
  *     for non-IDE callers (e.g. legacy CLI invocations) that have no callerId.
@@ -119,7 +116,6 @@ function readPresenceReadOnly(projectRoot, callerId) {
     // spreads `input.mode` when present); the typed `SkillPresenceLease` does
     // not declare it, so widen the read shape here. Normalized on read: a
     // legacy `'swarm'` lease renders as `'full-auto'` (slice
-    // 2026-09-09-mode-consolidation).
     const latestMode = normalizeSkillPresenceMode(latest.mode);
     return {
         presence: {
@@ -137,7 +133,6 @@ export function buildStatusLineModel(stdin, nowMs) {
     // and reads `.peaks/_runtime/<sid>/compact-lifecycle.json` (or its legacy
     // fallbacks). It replaces the active skill content when kind != 'none'.
     const compact = readCompactState(projectRoot, nowMs);
-    // Slice 2026-08-05-statusline-sid-only-marker: resolve the canonical
     // session id once, up front, so the renderer can read it from the model
     // without re-running `getSessionIdCanonical`. `null` when the project
     // root is unbound OR when no `.peaks/_runtime/<sid>/` session exists.
@@ -221,7 +216,6 @@ export function buildStatusLineModel(stdin, nowMs) {
     catch {
         activeLeaf = null;
     }
-    // Slice rid-statusline-24h-overlay (2026-08-10): read the 24h-mode
     // overlay snapshot ONLY when state === 'active'. Stale / idle /
     // invalid-presence / idle-via-outer-mismatch never carry the suffix
     // (per PRD §Non-goals.6 — "不在 idle / stale / invalid-presence

package/dist/services/skills/skill-statusline-sid-suffix.d.ts

@@ -2,7 +2,6 @@
  * Pure short-sid suffix helpers for the Peaks statusLine.
  *
  * Extracted from `skill-statusline-renderer.ts` (slice
- * 2026-08-05-statusline-sid-only-marker-and-multi-binary-drift-guard
  * repair cycle) to keep the renderer under the Karpathy 800-line cap.
  * The module is I/O-free and only depends on the read-only
  * `StatusLineModel` shape from `skill-statusline-service.ts` plus the
@@ -32,7 +31,6 @@ export interface SidSuffixPalette {
  * the input is empty. Pure; safe for ASCII rendering across
  * PowerShell, Git Bash, and zsh (AC7).
  *
- * Slice 2026-08-05-statusline-empty-render-and-short-sid-suffix.
  */
 export declare function formatShortSid(sessionId: string): string;
 /**

package/dist/services/skills/skill-statusline-sid-suffix.js

@@ -2,7 +2,6 @@
  * Pure short-sid suffix helpers for the Peaks statusLine.
  *
  * Extracted from `skill-statusline-renderer.ts` (slice
- * 2026-08-05-statusline-sid-only-marker-and-multi-binary-drift-guard
  * repair cycle) to keep the renderer under the Karpathy 800-line cap.
  * The module is I/O-free and only depends on the read-only
  * `StatusLineModel` shape from `skill-statusline-service.ts` plus the
@@ -22,7 +21,6 @@
  * the input is empty. Pure; safe for ASCII rendering across
  * PowerShell, Git Bash, and zsh (AC7).
  *
- * Slice 2026-08-05-statusline-empty-render-and-short-sid-suffix.
  */
 export function formatShortSid(sessionId) {
     if (sessionId.length === 0)

package/dist/services/skills/statusline-palette.d.ts

@@ -1,6 +1,5 @@
 /**
  * Visual / palette / SGR rendering block extracted from
- * `skill-statusline-renderer.ts` (slice 2026-09-06-split-batch-b) so the
  * renderer stays under the 800-line cap. Behaviour-preserving verbatim move;
  * `export` keywords were added to the symbols the renderer still imports.
  */
@@ -36,7 +35,6 @@ interface CompactPalette {
     readonly preparing: string;
     readonly compacting: string;
     /**
-     * Slice 2026-09-12-compact-band-policy: a trigger is registered but no
      * compaction is running. Rendered WITHOUT a bar — see
      * `renderCompact` in skill-statusline-renderer.ts.
      */

package/dist/services/skills/statusline-palette.js

@@ -1,6 +1,5 @@
 /**
  * Visual / palette / SGR rendering block extracted from
- * `skill-statusline-renderer.ts` (slice 2026-09-06-split-batch-b) so the
  * renderer stays under the 800-line cap. Behaviour-preserving verbatim move;
  * `export` keywords were added to the symbols the renderer still imports.
  */
@@ -105,7 +104,6 @@ function buildPalette(capability, noColor) {
         return {
             active: '*',
             idle: 'o',
-            // Slice rid-statusline-stale-ux AC-1: stale residue uses the same
             // glyph as `idle` (`o`) but stays static (no slow-blink — the user
             // is reading a *previous* session's residue, not a live idle state).
             // The neutral copy `(previous session · N days ago)` is the
@@ -133,7 +131,6 @@ function buildPalette(capability, noColor) {
     return {
         active: brandGlyph('●'),
         idle: blinkBrand('○'),
-        // Slice rid-statusline-stale-ux AC-1: muted slate (`#AAAAC8` dim)
         // — slow-blink OFF, distinct from `idle` (slow-blink brand) and
         // `warning` (yellow invalid-presence). The stale branch is
         // semantically "previous-session residue" (neutral), NOT an error.

package/dist/services/slice/slice-archive-service.js

@@ -2,7 +2,6 @@
  * Slice #009 / G5 RL-8 — sub-agent dispatch record archival + 30-day GC.
  *
  * Called by the `peaks session finish` / `peaks session abandon` /
- * new-rid-startup hooks. Walks the per-session `.peaks/_sub_agents/<sid>/`
  * tree and moves completed + disposed records to
  * `.peaks/_runtime/<sid>/_archive/_sub_agents/<sliceId>/`.
  *

package/dist/services/slice/slice-benchmark-service.d.ts

@@ -1,5 +1,4 @@
 /**
- * Slice benchmark wrapper (slice 2026-06-14-fzf-rollout).
  *
  * Wraps `decomposeSlices` with a thin observability layer that records
  * total wall time, codegraph call count, confidence distribution, and

package/dist/services/slice/slice-benchmark-service.js

@@ -1,5 +1,4 @@
 /**
- * Slice benchmark wrapper (slice 2026-06-14-fzf-rollout).
  *
  * Wraps `decomposeSlices` with a thin observability layer that records
  * total wall time, codegraph call count, confidence distribution, and

package/dist/services/slice/slice-check-service.js

@@ -2,7 +2,6 @@ import { execFileSync } from 'node:child_process';
 import { existsSync, readFileSync, statSync } from 'node:fs';
 import { join } from 'node:path';
 import { isDirectory } from 'peaks-loop-shared/fs';
-// Slice 2026-06-29-change-id-root-removal: `getCurrentChangeId` was
 // removed with the change-id axis. Slice check resolves the rid from
 // `options.rid` only; the binding file at `.peaks/_runtime/current-change`
 // is no longer read. Path-safety helpers now live at
@@ -206,7 +205,6 @@ async function runUnitTests(projectRoot, runTests) {
     // related to git-changed files. Cost drops from 30s+ to ~1-3s in steady
     // state. Opt-in to the full suite via `runTests: true` (CLI flag
     // `--run-tests`). See `references/runbook.md` for the rationale and
-    // `tests/unit/slice-check-service.test.ts` for the regression net.
     // Per Windows npx ENOENT (observations 2317+2792), resolve
     // the project-local vitest binary instead of shelling out
     // through npx. 2026-09-10 C6: that binary is the package's JS
@@ -245,7 +243,6 @@ async function runUnitTests(projectRoot, runTests) {
         }
     };
 }
-// Slice `2026-09-14-audit-artifact-rid-scoping`: the evidence filenames
 // carry the rid now. Candidate order is canonical-first, then the
 // back-compat tiers — the same order `artifact-prerequisites.ts` resolves
 // in, so this boundary gate and the transition gate agree on which file is
@@ -257,7 +254,6 @@ const REVIEW_FILES = [
         label: 'code-review'
     },
     // v2.12.0 collapse: security + perf moved to standalone audit skills.
-    // `slice check` accepts the rid-scoped audit path, the bare v2.12.0 path
     // OR the v2.11.x legacy path during the 1-minor-release back-compat
     // window (v2.13.0 hard-deletes the legacy paths — see CHANGELOG [2.12.0]).
     {
@@ -301,7 +297,6 @@ async function runReviewFanout(projectRoot, rid, refresh) {
         let hit = null;
         // Back-compat: each entry lists multiple candidate paths. First hit (in
         // declared order) wins; canonical paths come first so a current slice
-        // preferentially reports its own rid-scoped evidence even when a legacy
         // file is also present during migration.
         const candidates = review.paths.map((candidate) => candidate.replace('<rid>', rid));
         for (const candidate of candidates) {
@@ -375,7 +370,6 @@ export async function sliceCheck(options) {
     if (!(await isDirectory(peaksRoot))) {
         throw new Error(`.peaks/ not found at ${options.projectRoot}. Run peaks workspace init first.`);
     }
-    // Slice 2026-06-29-change-id-root-removal: resolve rid from the
     // explicit `--rid` option only. The `current-change` binding file is
     // gone; the CLI is the single source of truth for the rid.
     if (options.rid === undefined) {

package/dist/services/slice/slice-check-types.d.ts

@@ -69,7 +69,6 @@ export type SliceCheckResult = {
 };
 export type SliceCheckOptions = {
     projectRoot: string;
-    /** REQUIRED. The `.peaks/_runtime/current-change` binding file is gone (slice 2026-06-29-change-id-root-removal); when omitted, slice check throws rather than guessing. */
     rid?: string;
     /**
      * When true, re-run the 3-way review fan-out (peaks-rd's code-review +

package/dist/services/slice/slice-pick-service.d.ts

@@ -1,7 +1,6 @@
 /**
  * Slice Pick Service — thin wrapper around the generic fzf picker.
  *
- * v2 (slice 2026-06-14-fzf-rollout): the actual fzf
  * integration is now in `src/services/fuzzy-matching/fzf-pick-service.ts`.
  * This file only knows how to format / parse SliceCandidate rows and
  * pick the output path. The algorithm itself (slice-decompose-service)

package/dist/services/slice/slice-pick-service.js

@@ -1,7 +1,6 @@
 /**
  * Slice Pick Service — thin wrapper around the generic fzf picker.
  *
- * v2 (slice 2026-06-14-fzf-rollout): the actual fzf
  * integration is now in `src/services/fuzzy-matching/fzf-pick-service.ts`.
  * This file only knows how to format / parse SliceCandidate rows and
  * pick the output path. The algorithm itself (slice-decompose-service)

package/dist/services/slice/slice-review-state.js

@@ -47,8 +47,6 @@ export function getReviewDir(projectRoot, sessionId) {
     //
     // It does NOT cover the slice-id axis: the slice id is joined one function
     // later, in `getReviewPath` below. Corrected 2026-09-14 (repair R1) — this
-    // comment previously said one guard covered the whole family; the security
-    // audit of `2026-09-14-cli-id-escape-instrumentation` (F1b) measured that
     // false: `slice-review '../../../../…/EVILSL'` wrote a `.json` file outside
     // the project root under `ok: true`.
     if (isUnsafePathInput(sessionId)) {

package/dist/services/sqlite/sqlite-driver.d.ts

@@ -0,0 +1,118 @@
+/**
+ * The SQLite driver seam for every store in this CLI.
+ *
+ * WHY A SEAM AT ALL. `better-sqlite3` is a native addon: a consumer either got a prebuilt
+ * binary matching their exact Node ABI or they needed a C++ toolchain, and the failure was
+ * discovered at runtime, not at install. Node ships `node:sqlite`, so the stores do not
+ * need that requirement. But the two are NOT the same library — the three places they
+ * genuinely differ are the whole reason this file exists, and each is a behaviour, not an
+ * import path:
+ *
+ *   - **there is no `pragma()`.** `exec('PRAGMA …')` sets a pragma but returns nothing, so
+ *     reading one back needs a statement (`pragmaValue`). A pragma that is silently not
+ *     applied is worse than no pragma: `foreign_keys = ON` is what makes the skillhub
+ *     schema's REFERENCES clauses mean anything.
+ *   - **`BEGIN` inside a transaction throws.** better-sqlite3's `db.transaction(fn)` nests
+ *     with SAVEPOINTs for free, so a store whose body called another store's body worked.
+ *     Here nesting is explicit and counted, and the inner unit rolls back on its own.
+ *   - **a read-only open must not create the file.** `codegraph-index-integrity` opens the
+ *     index read-only; an empty database created by the open is indistinguishable from an
+ *     index with no rows, and the staleness gate would report a clean graph for a project
+ *     that was never indexed.
+ *   - **`foreign_keys` is ON by default here and was OFF in better-sqlite3.** Measured on
+ *     Node 24.21 (`PRAGMA foreign_keys` answers 1 on a fresh database). The stores that
+ *     asked for it are unaffected; a site that never asked — the capability guard's
+ *     `:memory:` probe — gains enforcement, so write order that used to work can start
+ *     throwing. That is why the call sites keep saying the pragma out loud.
+ *
+ * WHAT THIS IS NOT. It is not an ORM and not a query builder: statements stay at the call
+ * sites, and `prepare`/`run`/`get`/`all`/`exec`/`close` are node:sqlite's own. Only the
+ * three behaviours above are wrapped, because those are the ones a port gets wrong quietly.
+ */
+import { DatabaseSync } from 'node:sqlite';
+/** The database handle the stores hold. Exported so call sites stop naming the addon. */
+export type SqliteDatabase = DatabaseSync;
+/**
+ * What SQLite accepts as a bound value, and what it hands back.
+ *
+ * Re-exported from the seam rather than imported from `node:sqlite` at the call sites for
+ * one reason: `SQLInputValue` EXCLUDES `undefined`, while better-sqlite3 silently bound
+ * `undefined` as NULL. Every store that builds a parameter list wants to say "these are the
+ * values I bind" once, in the name the driver actually enforces — and if that name is
+ * spelled differently in twenty files, the twenty drift.
+ */
+export type { SQLInputValue as SqlInputValue, SQLOutputValue as SqlOutputValue } from 'node:sqlite';
+export type OpenSqliteOptions = {
+    /**
+     * Open without creating. A missing file is an error, not an empty database — the
+     * read-only caller's question is "what does the existing index say", and an empty
+     * database answers that in the most misleading way available.
+     */
+    readonly readOnly?: boolean;
+};
+/**
+ * Open (or create) the SQLite file at `path`.
+ *
+ * `readOnly` on a path that does not exist throws here rather than producing a handle over
+ * a freshly created empty file — see the option.
+ */
+export declare function openSqlite(path: string, options?: OpenSqliteOptions): SqliteDatabase;
+/**
+ * Apply each `PRAGMA` setting, in order.
+ *
+ * A `;` is refused rather than passed through: these strings are literals today, and the
+ * shape that would hurt is a future caller interpolating a name into one and landing a
+ * second statement inside a single `exec`.
+ */
+export declare function applyPragmas(db: SqliteDatabase, pragmas: readonly string[]): void;
+/**
+ * Read one `PRAGMA` back.
+ *
+ * `journal_mode` answers with a row keyed `journal_mode`; `foreign_keys` answers with a
+ * row keyed `foreign_keys`. Both come back as the FIRST column, whatever the name, so that
+ * is what this returns.
+ */
+export declare function pragmaValue(db: SqliteDatabase, name: string): unknown;
+/**
+ * Run `body` as ONE unit of work: commit if it returns, roll back everything it wrote if
+ * it throws, and let the error continue.
+ *
+ * Nesting is by SAVEPOINT, which is what `db.transaction(fn)` did in better-sqlite3: an
+ * inner unit that fails undoes only itself, and an outer unit that fails undoes both. The
+ * alternative — a bare `BEGIN` — throws the moment one store body calls another, which is
+ * the least-tested path in the product and the reason this function is not five lines.
+ */
+export declare function withTransaction<T>(db: SqliteDatabase, body: () => T): T;
+/**
+ * Which constraint a thrown SQLite error violated.
+ *
+ * WHY THIS EXISTS. `loop-bee-relation-service` turns a duplicate relation into the
+ * documented `DUP_RELATION` / `TWO_MAIN_BEES` errors and an absent parent into `FK_*` by
+ * asking which constraint failed. It used to ask
+ * `err.code === 'SQLITE_CONSTRAINT_UNIQUE'`, which better-sqlite3 set. node:sqlite sets
+ * `code` to the generic `ERR_SQLITE_ERROR` for every SQL failure and puts the real
+ * extended result code in `errcode` — measured on this host: 2067 for
+ * `SQLITE_CONSTRAINT_UNIQUE`, 787 for `SQLITE_CONSTRAINT_FOREIGNKEY`. A `.code` comparison
+ * therefore does not throw the wrong error, it throws NOTHING: the branch is skipped and a
+ * raw driver message reaches the operator where the CLI promised an integrity code. That
+ * failure is invisible to the type checker and to any test that does not drive a real
+ * violation, which is why the classifier has its own arms.
+ *
+ * Three readings, in order of trustworthiness: `errcode` (node:sqlite), `code`
+ * (better-sqlite3, and any error shaped like it), then the message. The message is a last
+ * resort rather than the primary because it is the only one of the three that SQLite
+ * documents as human-readable and free to change.
+ */
+export type SqliteConstraintKind = 'unique' | 'foreign-key';
+export declare function constraintKind(error: unknown): SqliteConstraintKind | undefined;
+/**
+ * Bind `body` as a unit of work WITHOUT running it, returned as a callable — the shape
+ * `better-sqlite3`'s `db.transaction(fn)` had, and the shape five stores in this repo are
+ * written in (`const tx = db.transaction(…)`, then `tx()` — sometimes more than once).
+ *
+ * This exists so the port is a name change and not a restructure, because the reuse is
+ * load-bearing: each invocation is its own unit, so a second call that fails must not undo
+ * a first call that committed. An arm in the driver's test calls it twice to prove that,
+ * since no other arm in this file would notice if it were written to run once.
+ */
+export declare function transaction<T>(db: SqliteDatabase, body: () => T): () => T;