peaks-loop 4.1.1 → 4.1.2

package/dist/services/sqlite/sqlite-driver.js

@@ -0,0 +1,159 @@
+/**
+ * The SQLite driver seam for every store in this CLI.
+ *
+ * WHY A SEAM AT ALL. `better-sqlite3` is a native addon: a consumer either got a prebuilt
+ * binary matching their exact Node ABI or they needed a C++ toolchain, and the failure was
+ * discovered at runtime, not at install. Node ships `node:sqlite`, so the stores do not
+ * need that requirement. But the two are NOT the same library — the three places they
+ * genuinely differ are the whole reason this file exists, and each is a behaviour, not an
+ * import path:
+ *
+ *   - **there is no `pragma()`.** `exec('PRAGMA …')` sets a pragma but returns nothing, so
+ *     reading one back needs a statement (`pragmaValue`). A pragma that is silently not
+ *     applied is worse than no pragma: `foreign_keys = ON` is what makes the skillhub
+ *     schema's REFERENCES clauses mean anything.
+ *   - **`BEGIN` inside a transaction throws.** better-sqlite3's `db.transaction(fn)` nests
+ *     with SAVEPOINTs for free, so a store whose body called another store's body worked.
+ *     Here nesting is explicit and counted, and the inner unit rolls back on its own.
+ *   - **a read-only open must not create the file.** `codegraph-index-integrity` opens the
+ *     index read-only; an empty database created by the open is indistinguishable from an
+ *     index with no rows, and the staleness gate would report a clean graph for a project
+ *     that was never indexed.
+ *   - **`foreign_keys` is ON by default here and was OFF in better-sqlite3.** Measured on
+ *     Node 24.21 (`PRAGMA foreign_keys` answers 1 on a fresh database). The stores that
+ *     asked for it are unaffected; a site that never asked — the capability guard's
+ *     `:memory:` probe — gains enforcement, so write order that used to work can start
+ *     throwing. That is why the call sites keep saying the pragma out loud.
+ *
+ * WHAT THIS IS NOT. It is not an ORM and not a query builder: statements stay at the call
+ * sites, and `prepare`/`run`/`get`/`all`/`exec`/`close` are node:sqlite's own. Only the
+ * three behaviours above are wrapped, because those are the ones a port gets wrong quietly.
+ */
+import { existsSync } from 'node:fs';
+import { DatabaseSync } from 'node:sqlite';
+/**
+ * Open (or create) the SQLite file at `path`.
+ *
+ * `readOnly` on a path that does not exist throws here rather than producing a handle over
+ * a freshly created empty file — see the option.
+ */
+export function openSqlite(path, options = {}) {
+    const readOnly = options.readOnly === true;
+    if (readOnly && !existsSync(path)) {
+        throw new Error(`no such file (opened read-only): ${path}`);
+    }
+    return new DatabaseSync(path, { readOnly });
+}
+/**
+ * Apply each `PRAGMA` setting, in order.
+ *
+ * A `;` is refused rather than passed through: these strings are literals today, and the
+ * shape that would hurt is a future caller interpolating a name into one and landing a
+ * second statement inside a single `exec`.
+ */
+export function applyPragmas(db, pragmas) {
+    for (const pragma of pragmas) {
+        if (pragma.includes(';')) {
+            throw new Error(`a pragma must be one statement, got: ${pragma}`);
+        }
+        db.exec(`PRAGMA ${pragma}`);
+    }
+}
+/**
+ * Read one `PRAGMA` back.
+ *
+ * `journal_mode` answers with a row keyed `journal_mode`; `foreign_keys` answers with a
+ * row keyed `foreign_keys`. Both come back as the FIRST column, whatever the name, so that
+ * is what this returns.
+ */
+export function pragmaValue(db, name) {
+    if (name.includes(';')) {
+        throw new Error(`a pragma name must be one statement, got: ${name}`);
+    }
+    const row = db.prepare(`PRAGMA ${name}`).get();
+    if (row === undefined)
+        return undefined;
+    const values = Object.values(row);
+    return values[0];
+}
+/** The depth of open transactions per handle, so nesting is counted, not guessed. */
+const transactionDepth = new WeakMap();
+/**
+ * Run `body` as ONE unit of work: commit if it returns, roll back everything it wrote if
+ * it throws, and let the error continue.
+ *
+ * Nesting is by SAVEPOINT, which is what `db.transaction(fn)` did in better-sqlite3: an
+ * inner unit that fails undoes only itself, and an outer unit that fails undoes both. The
+ * alternative — a bare `BEGIN` — throws the moment one store body calls another, which is
+ * the least-tested path in the product and the reason this function is not five lines.
+ */
+export function withTransaction(db, body) {
+    const depth = transactionDepth.get(db) ?? 0;
+    transactionDepth.set(db, depth + 1);
+    const savepoint = `peaks_sp_${String(depth + 1)}`;
+    if (depth === 0) {
+        db.exec('BEGIN');
+    }
+    else {
+        db.exec(`SAVEPOINT ${savepoint}`);
+    }
+    try {
+        const result = body();
+        if (depth === 0) {
+            db.exec('COMMIT');
+        }
+        else {
+            db.exec(`RELEASE ${savepoint}`);
+        }
+        return result;
+    }
+    catch (error) {
+        if (depth === 0) {
+            db.exec('ROLLBACK');
+        }
+        else {
+            db.exec(`ROLLBACK TO ${savepoint}`);
+            db.exec(`RELEASE ${savepoint}`);
+        }
+        throw error;
+    }
+    finally {
+        transactionDepth.set(db, depth);
+    }
+}
+/** `SQLITE_CONSTRAINT_UNIQUE` — 19 | (8 << 8). */
+const SQLITE_ERRCODE_CONSTRAINT_UNIQUE = 2067;
+/** `SQLITE_CONSTRAINT_FOREIGNKEY` — 19 | (3 << 8). */
+const SQLITE_ERRCODE_CONSTRAINT_FOREIGNKEY = 787;
+export function constraintKind(error) {
+    if (typeof error !== 'object' || error === null)
+        return undefined;
+    const shaped = error;
+    if (shaped.errcode === SQLITE_ERRCODE_CONSTRAINT_UNIQUE)
+        return 'unique';
+    if (shaped.errcode === SQLITE_ERRCODE_CONSTRAINT_FOREIGNKEY)
+        return 'foreign-key';
+    if (shaped.code === 'SQLITE_CONSTRAINT_UNIQUE')
+        return 'unique';
+    if (shaped.code === 'SQLITE_CONSTRAINT_FOREIGNKEY')
+        return 'foreign-key';
+    const message = error instanceof Error ? error.message : '';
+    if (message.includes('UNIQUE constraint failed'))
+        return 'unique';
+    if (message.includes('FOREIGN KEY constraint failed'))
+        return 'foreign-key';
+    return undefined;
+}
+/**
+ * Bind `body` as a unit of work WITHOUT running it, returned as a callable — the shape
+ * `better-sqlite3`'s `db.transaction(fn)` had, and the shape five stores in this repo are
+ * written in (`const tx = db.transaction(…)`, then `tx()` — sometimes more than once).
+ *
+ * This exists so the port is a name change and not a restructure, because the reuse is
+ * load-bearing: each invocation is its own unit, so a second call that fails must not undo
+ * a first call that committed. An arm in the driver's test calls it twice to prove that,
+ * since no other arm in this file would notice if it were written to run once.
+ */
+export function transaction(db, body) {
+    return () => withTransaction(db, body);
+}

package/dist/services/standards/ide-aware-standards-service.d.ts

@@ -1,7 +1,6 @@
 /**
  * IDE-aware wrapper for `peaks standards init` / `peaks standards update`.
  *
- * Slice #011-2026-06-07-ide-adapter-resource-profile: the original
  * `executeProjectStandardsInit` / `executeProjectStandardsUpdate` always
  * wrote to `CLAUDE.md` + `.claude/rules/**` regardless of which IDE
  * the user was running. This wrapper dispatches on the IDE detected
@@ -76,7 +75,6 @@ export declare function executeProjectStandardsUpdateIdeAware(options: ProjectSt
 /**
  * Test seam + integration-test helper: returns the resolved IDE id
  * for the call, plus the active standards profile. Exported for
- * the integration test in `tests/unit/standards/ide-aware-standards-service.test.ts`
  * to assert the dispatch decision without running the full write.
  */
 export declare function inspectStandardsDispatch(options: {

package/dist/services/standards/ide-aware-standards-service.js

@@ -73,7 +73,6 @@ export function executeProjectStandardsUpdateIdeAware(options) {
 /**
  * Test seam + integration-test helper: returns the resolved IDE id
  * for the call, plus the active standards profile. Exported for
- * the integration test in `tests/unit/standards/ide-aware-standards-service.test.ts`
  * to assert the dispatch decision without running the full write.
  */
 export function inspectStandardsDispatch(options) {

package/dist/services/standards/loop-engineering-readiness-lint.d.ts

@@ -71,7 +71,6 @@ export declare const LOOP_ENGINEERING_GUIDELINE_PATHS: readonly [".peaks/standar
  * The allowlist of CLI verbs that a peaks-* SKILL.md may legitimately
  * instruct an LLM to invoke on the user's behalf. These are the
  * sediment / asset / evolution surface verbs introduced in
- * 2026-07-07-loop-engineering-crystallization-design §7.4 plus the
  * 18-verb sediment pool from 2026-07-04-peaks-maker-dynamic-skill-
  * sediment-design §4.2.
  *

package/dist/services/standards/loop-engineering-readiness-lint.js

@@ -65,7 +65,6 @@ export const LOOP_ENGINEERING_GUIDELINE_PATHS = [
  * The allowlist of CLI verbs that a peaks-* SKILL.md may legitimately
  * instruct an LLM to invoke on the user's behalf. These are the
  * sediment / asset / evolution surface verbs introduced in
- * 2026-07-07-loop-engineering-crystallization-design §7.4 plus the
  * 18-verb sediment pool from 2026-07-04-peaks-maker-dynamic-skill-
  * sediment-design §4.2.
  *

package/dist/services/standards/migrate-claude-rules-service.js

@@ -1,6 +1,5 @@
 /**
  * peaks standards migrate — .claude/rules/ tree thinning.
- * Slice: 2026-06-12-standards-migrate-claude-rules.
  *
  * The 1.x peaks-loop install copied a thick .claude/rules
  * tree (skill-first / CLI-auxiliary / dogfood / commit-trailer
@@ -110,7 +109,6 @@ export function migrateClaudeRules(input) {
     // earlier migration run. The backup is real content (not a pointer),
     // so without this filter a second run would treat the backup dir as
     // a fresh thick tree and re-thin / re-scaffold over it
-    // (slice 2026-07-15-ice-cola-dogfood).
     const BACKUP_DIR_PREFIX = '.peaks-2.0-backup-';
     const thickFiles = existingRulesFiles.filter((f) => {
         if (isAlreadyPointer(f))
@@ -149,7 +147,6 @@ export function migrateClaudeRules(input) {
                     // the top-level backup dir, not the nested language pack
                     // dirs. Without this mkdirSync, the first file written to
                     // a nested subdir ENOENTs and the whole backup silently
-                    // becomes empty (slice 2026-07-15-ice-cola-dogfood).
                     mkdirSync(dirname(destPath), { recursive: true });
                     writeFileSync(destPath, body, 'utf8');
                 }

package/dist/services/standards/migrate-service.d.ts

@@ -1,5 +1,4 @@
 /**
- * Slice 028 (Q2=A): `peaks standards migrate` rewrites a consumer
  * project's `CLAUDE.md` to drop the legacy heartbeat block.
  *
  * The legacy block (rendered by `peaks standards init` / `peaks

package/dist/services/standards/migrate-service.js

@@ -1,7 +1,6 @@
 import { existsSync, readFileSync, writeFileSync } from 'node:fs';
 import { isAbsolute, resolve } from 'node:path';
 /**
- * Slice 028 (Q2=A): `peaks standards migrate` rewrites a consumer
  * project's `CLAUDE.md` to drop the legacy heartbeat block.
  *
  * The legacy block (rendered by `peaks standards init` / `peaks

package/dist/services/standards/missing-standards-detector.d.ts

@@ -1,5 +1,4 @@
 /**
- * Slice 2026-06-16-peaks-code-auto-scaffold (RD#7) — missing-standards-detector.
  *
  * Read-side companion to the `peaks standards init` / `peaks standards update`
  * writers in `./project-standards-service.ts`. The writer KNOWS how to scaffold
@@ -71,7 +70,6 @@ export declare function diagnoseStandardsTree(projectRoot: string, language: Sta
  * Detect whether a consumer project's `.peaks/standards/` tree (2.0
  * canonical) is missing or empty.
  *
- * Rules (per PRD R2, slice 2026-07-15):
  *   - `.peaks/standards/common/` MUST exist AND contain at least one
  *     `.md` file.
  *   - `.peaks/standards/<language>/` MUST exist AND contain at least one

package/dist/services/standards/missing-standards-detector.js

@@ -1,5 +1,4 @@
 /**
- * Slice 2026-06-16-peaks-code-auto-scaffold (RD#7) — missing-standards-detector.
  *
  * Read-side companion to the `peaks standards init` / `peaks standards update`
  * writers in `./project-standards-service.ts`. The writer KNOWS how to scaffold
@@ -44,7 +43,6 @@ function renderForPlatform(projectRoot) {
     // the same separator via the literal '\\' join below.
     //
     // 2.0 canonical location: `<projectRoot>/.peaks/standards/`
-    // (slice 2026-07-15-missing-standards-on-fresh-project — the 2.0
     // writer scaffolds the rules tree under `.peaks/standards/`, not
     // the legacy `.claude/rules/`).
     if (process.platform === 'win32') {
@@ -84,7 +82,6 @@ export function diagnoseStandardsTree(projectRoot, language) {
  * Detect whether a consumer project's `.peaks/standards/` tree (2.0
  * canonical) is missing or empty.
  *
- * Rules (per PRD R2, slice 2026-07-15):
  *   - `.peaks/standards/common/` MUST exist AND contain at least one
  *     `.md` file.
  *   - `.peaks/standards/<language>/` MUST exist AND contain at least one

package/dist/services/standards/project-standards-service.d.ts

@@ -102,7 +102,6 @@ export type ProjectStandardsInitOptions = {
 };
 /**
  * Public alias for `detectLanguageInternal` so callers outside this
- * module (e.g. `workspace-service.ts` for the slice 2026-06-16 RD#7
  * auto-detect path) can ask the same heuristic without re-implementing
  * the file-probe logic.
  */

package/dist/services/standards/project-standards-service.js

@@ -109,7 +109,6 @@ function detectLanguageInternal(projectRoot) {
 }
 /**
  * Public alias for `detectLanguageInternal` so callers outside this
- * module (e.g. `workspace-service.ts` for the slice 2026-06-16 RD#7
  * auto-detect path) can ask the same heuristic without re-implementing
  * the file-probe logic.
  */

package/dist/services/standards/standards-render.d.ts

@@ -1,6 +1,5 @@
 /**
  * Pure render / template functions extracted from
- * `project-standards-service.ts` (slice 2026-09-06-split-batch-b) so the
  * service stays under the 800-line cap. Behaviour-preserving verbatim move;
  * `export` keywords were added to the symbols the service still imports.
  */

package/dist/services/standards/standards-render.js

@@ -1,6 +1,5 @@
 /**
  * Pure render / template functions extracted from
- * `project-standards-service.ts` (slice 2026-09-06-split-batch-b) so the
  * service stays under the 800-line cap. Behaviour-preserving verbatim move;
  * `export` keywords were added to the symbols the service still imports.
  */

package/dist/services/standards/ui-library-dispatch-block.d.ts

@@ -1,5 +1,4 @@
 /**
- * Slice 2026-09-06-ui-lib-dispatch-priority: render a `## Project stack`
  * markdown block for the RD/UI sub-agent dispatch system prompt, and the
  * dispatch-site convenience wrapper that computes it from a project root.
  *

package/dist/services/standards/ui-library-dispatch-block.js

@@ -1,5 +1,4 @@
 /**
- * Slice 2026-09-06-ui-lib-dispatch-priority: render a `## Project stack`
  * markdown block for the RD/UI sub-agent dispatch system prompt, and the
  * dispatch-site convenience wrapper that computes it from a project root.
  *

package/dist/services/tech/tech-change-id-service.d.ts

@@ -1,5 +1,4 @@
 /**
- * tech-change-id-service — change-id-axis slice of the tech planner (rid-012).
  *
  * Purpose:
  *   The original `peaks tech plan` / `peaks tech status` (in `tech-service.ts`)
@@ -7,7 +6,6 @@
  *   v2.19.0). This module provides the *consumer-side wiring* that lets the
  *   same CLI surface be re-keyed by an explicit `--change-id <id>` for the
  *   OpenSpec / change-driven workflow. The path math, change-id validation,
- *   and workspace-unavailable response are all delegated to the rid-009
  *   helpers in `src/services/openspec/artifact-boundary.ts`.
  *
  * Style:
@@ -17,9 +15,7 @@
  *
  * Hard ban:
  *   - This file MUST NOT import from `peaks-loop-shared` (stays inside
- *     peaks-loop per §9 of the rid-012 plan).
  *   - This file MUST NOT touch `src/services/openspec/artifact-boundary.ts`
- *     (rid-009 helpers are frozen; we only consume via import).
  */
 import type { WorkspaceConfig } from '../config/config-types.js';
 import { type BoundaryError, type ChangeIdError, type PlanArtifactPathOutput, type WorkspaceUnavailableResponse, type Result } from '../openspec/artifact-boundary.js';
@@ -43,7 +39,6 @@ export type TechChangeStatus = {
 };
 /**
  * Validate a change-id string. This is a thin consumer-side wrapper that
- * delegates to `validateChangeId` (rid-009). The wrapper exists so the
  * change-id-axis service has a single named export point (`validateTechChangeId`)
  * and so the test file can import it without reaching across to openspec.
  */
@@ -58,7 +53,6 @@ export declare function validateTechChangeId(id: string): Result<{
  *   - `reviewChecklist`     → `<id>/architecture/tech-review-checklist.md`
  *   - `approvalTemplate`    → `<id>/architecture/tech-approval-record.template.md`
  *
- * Delegates to `planArtifactPath` (rid-009) for each one. Returns the FIRST
  * failure (so callers get a single, deterministic BoundaryError).
  *
  * Pure path math — does not touch the filesystem.
@@ -70,7 +64,6 @@ export declare function planTechArtifactPath(input: {
 }): Result<TechChangeArtifacts, BoundaryError>;
 /**
  * Build the workspace-unavailable response for the change-id-axis tech
- * planner. Thin wrapper around `buildWorkspaceUnavailable` (rid-009) so
  * the same single source of truth (nextActions constant) is reused.
  *
  * The `mode` discriminator matches the existing artifact-boundary shape

package/dist/services/tech/tech-change-id-service.js

@@ -1,5 +1,4 @@
 /**
- * tech-change-id-service — change-id-axis slice of the tech planner (rid-012).
  *
  * Purpose:
  *   The original `peaks tech plan` / `peaks tech status` (in `tech-service.ts`)
@@ -7,7 +6,6 @@
  *   v2.19.0). This module provides the *consumer-side wiring* that lets the
  *   same CLI surface be re-keyed by an explicit `--change-id <id>` for the
  *   OpenSpec / change-driven workflow. The path math, change-id validation,
- *   and workspace-unavailable response are all delegated to the rid-009
  *   helpers in `src/services/openspec/artifact-boundary.ts`.
  *
  * Style:
@@ -17,9 +15,7 @@
  *
  * Hard ban:
  *   - This file MUST NOT import from `peaks-loop-shared` (stays inside
- *     peaks-loop per §9 of the rid-012 plan).
  *   - This file MUST NOT touch `src/services/openspec/artifact-boundary.ts`
- *     (rid-009 helpers are frozen; we only consume via import).
  */
 import { buildWorkspaceUnavailable, planArtifactPath, validateChangeId } from '../openspec/artifact-boundary.js';
 /**
@@ -32,7 +28,6 @@ const TECH_CHANGE_ID_WAVES = ['scan', 'document', 'review', 'reducer'];
 const TECH_ARCHITECTURE_ROOT = '<changeId>/architecture';
 /**
  * Validate a change-id string. This is a thin consumer-side wrapper that
- * delegates to `validateChangeId` (rid-009). The wrapper exists so the
  * change-id-axis service has a single named export point (`validateTechChangeId`)
  * and so the test file can import it without reaching across to openspec.
  */
@@ -47,7 +42,6 @@ export function validateTechChangeId(id) {
  *   - `reviewChecklist`     → `<id>/architecture/tech-review-checklist.md`
  *   - `approvalTemplate`    → `<id>/architecture/tech-approval-record.template.md`
  *
- * Delegates to `planArtifactPath` (rid-009) for each one. Returns the FIRST
  * failure (so callers get a single, deterministic BoundaryError).
  *
  * Pure path math — does not touch the filesystem.
@@ -106,7 +100,6 @@ export function planTechArtifactPath(input) {
 }
 /**
  * Build the workspace-unavailable response for the change-id-axis tech
- * planner. Thin wrapper around `buildWorkspaceUnavailable` (rid-009) so
  * the same single source of truth (nextActions constant) is reused.
  *
  * The `mode` discriminator matches the existing artifact-boundary shape

package/dist/services/tech/tech-service.js

@@ -62,7 +62,6 @@ function assertNonEmptyGoal(goal) {
     }
 }
 function architectureRoot(_sessionId) {
-    // Slice 2026-06-29-change-id-root-removal: descriptor is now the bare
     // role-relative sub-path `<role>/architecture` (no `.peaks/_runtime/...`
     // prefix). The on-disk location is resolved by `architectureRootAbs`
     // via `getSessionDir`. Callers that previously split this string on
@@ -71,7 +70,6 @@ function architectureRoot(_sessionId) {
     return 'rd/architecture';
 }
 function architectureRootAbs(artifactWorkspacePath, sessionId) {
-    // Slice 2026-06-29-change-id-root-removal: on-disk path now resolves
     // via the session-axis `getSessionDir(root, sessionId)` (the change-id
     // identifier is reused as the session-dir name for tech-artifact
     // reads, matching the test helper `writeApprovedTechArtifacts` and
@@ -164,7 +162,6 @@ function isValidArtifactFile(rootPath, artifact) {
     }
 }
 function waveManifestPath(_sessionId, index, wave) {
-    // Slice 2026-06-29-change-id-root-removal: descriptor is now
     // `rd/architecture/waves/<file>`. The scope root is supplied by the
     // caller via `getSessionDir`.
     return `rd/architecture/waves/wave-${index + 1}-${wave}.json`;
@@ -173,7 +170,6 @@ function taskPurpose(taskId, goal) {
     return `${taskId.replace(/^tech-/, '').replace(/-/g, ' ')} for ${goal}`;
 }
 function createTechGraph(request) {
-    // Slice 2026-06-29-change-id-root-removal: change-id is metadata-only;
     // no structural validation gate fires here.
     assertNonEmptyGoal(request.goal);
     const [scanWave, documentWave, reviewWave] = TECH_WAVE_TASKS;
@@ -238,7 +234,6 @@ export function createTechPlan(request) {
     };
 }
 export function getTechStatus(options) {
-    // Slice 2026-06-29-change-id-root-removal: change-id is metadata-only;
     // no structural validation gate fires here.
     const artifactRoot = architectureRoot(options.sessionId);
     if (!options.artifactWorkspacePath) {

package/dist/services/verdict/envelope-parsers.d.ts

@@ -41,9 +41,7 @@ export type AnyEnvelope = {
     envelope: QaEnvelope;
 };
 /**
- * v2.13.3 AC-1 — parse real v2.12.0 audit markdown.
  *
- * Strategy (per PRD AC-1 mitigation):
  *   1. Try JSON.parse first (back-compat with prior unit tests + any
  *      consumer that passes a JSON string explicitly).
  *   2. Fall back to markdown parse: extract `verdict:` from YAML

package/dist/services/verdict/envelope-parsers.js

@@ -20,9 +20,7 @@ import { isPerfAuditEnvelope, isSecurityAuditEnvelope } from '../audit-independe
 import { matchEnum, parseAuditMarkdown, parseFindingBullet, parseKarpathyViolations } from './envelopes.js';
 // ─── 5 parsers (pure, never throw) ─────────────────────────────────────
 /**
- * v2.13.3 AC-1 — parse real v2.12.0 audit markdown.
  *
- * Strategy (per PRD AC-1 mitigation):
  *   1. Try JSON.parse first (back-compat with prior unit tests + any
  *      consumer that passes a JSON string explicitly).
  *   2. Fall back to markdown parse: extract `verdict:` from YAML

package/dist/services/verdict/envelopes.d.ts

@@ -1,5 +1,4 @@
 /**
- * peaks-loop v2.13.3 — Envelope unification (AC-1: real markdown parse).
  *
  * The 5 input envelopes feeding `aggregateVerdict()` have always been
  * heterogeneous (peaks-security-audit / peaks-perf-audit / karpathy /

package/dist/services/vm/vm-lease.js

@@ -1,7 +1,6 @@
 /**
  * vm-lease — pure-function lease store for `peaks vm spawn`.
  *
- * Slice 2026-07-29-worktree-l2-extended Part 35 (L4 VM runtime).
  * Parallels the design of `worktree-lease.ts` (Part 1) and
  * `container-lease.ts` (Part 12). The L4 VM isolation mode
  * (`--isolation vm` in dispatch) needs its own lease surface

package/dist/services/web/aria-node.d.ts

@@ -1,5 +1,4 @@
 /**
- * The `ariaSnapshotJSON()` node type (slice S1, AC2 — the mechanism).
  *
  * Split out of `snapshot-pruner.ts` to keep the pruner under the
  * 300-raw-line file cap; it is the data model the pruner, the renderer and

package/dist/services/web/bounded-output.d.ts

@@ -1,5 +1,4 @@
 /**
- * Byte-aware output caps for `peaks web` (slice S1, AC2).
  *
  * `capText` is the only absolute guarantee in the snapshot pipeline: the
  * pruner (`snapshot-pruner.ts`) bounds node count and depth, but only a byte

package/dist/services/web/bounded-output.js

@@ -1,5 +1,4 @@
 /**
- * Byte-aware output caps for `peaks web` (slice S1, AC2).
  *
  * `capText` is the only absolute guarantee in the snapshot pipeline: the
  * pruner (`snapshot-pruner.ts`) bounds node count and depth, but only a byte

package/dist/services/web/browser-acquire.js

@@ -1,5 +1,4 @@
 /**
- * Acquire the chromium browser (slice S1, file 10; S3 adds the ordered gate).
  *
  * The order is load-bearing and is the whole of AC5's first half (tech-doc §5.1):
  *

package/dist/services/web/browser-cache-probe.js

@@ -1,7 +1,6 @@
 /**
  * `src/services/web/browser-cache-probe.ts`
  *
- * The browser-cache probe (slice S3, file 18; R6, tech-doc §5.3): it asks the
  * resolved Playwright package where its executable WOULD be and checks the
  * filesystem — no download, no spawn, so `peaks web status` can report cache
  * state on a machine with nothing installed. Moved verbatim (wave 3, file-size

package/dist/services/web/browser-session-manager.js

@@ -1,5 +1,4 @@
 /**
- * All Playwright operations for `peaks web` (slice S1, file 11).
  *
  * One browser process per session; one browser CONTEXT per dispatch (Q8). The
  * context is what isolates cookies/localStorage between dispatches, which is

package/dist/services/web/daemon-entry.js

@@ -1,5 +1,4 @@
 /**
- * The `peaks web` daemon process entry (slice S2, file 15).
  *
  * This file IS the process: it is what `spawnDaemon` launches, so it must run
  * under plain `node` (built tree) as well as under `tsx` (source tree). It is

package/dist/services/web/daemon-registry.js

@@ -1,5 +1,4 @@
 /**
- * File + lock IO for the `peaks web` daemon (slice S1, file 7).
  *
  * Isolated from the HTTP client so each is testable alone (tech-doc §2). Every
  * WRITE goes through `assertUnder` first — the slice-wide guard against an

package/dist/services/web/daemon-supervisor.d.ts

@@ -50,9 +50,10 @@ export declare function interpreterArgs(entry: string): string[];
  * It arrived in 20.6.0 (backported to 18.19.0); below that the spelling is
  * `--loader`, and passing `--import` is a bad option that kills the daemon at
  * startup — inside a `READY_TIMEOUT_MS = 20 s` wait whose only diagnosis is a
- * line in `daemon.log`. `package.json` declares `engines.node >= 20.0.0`, which
- * includes 20.0–20.5, so the flag cannot be unconditional. `tsx` gates its own
- * child the same way and this mirrors it.
+ * line in `daemon.log`. `engines.node` names a higher floor, but this function answers for
+ * whatever interpreter the daemon is actually started with — a machine with several Nodes
+ * can hand `--import` to an older one — so the flag cannot be unconditional. `tsx` gates
+ * its own child the same way and this mirrors it.
  */
 export declare function supportsImportFlag(nodeVersion?: string): boolean;
 /**

package/dist/services/web/daemon-supervisor.js

@@ -1,5 +1,4 @@
 /**
- * CLI-side daemon lifecycle: reuse, cold start, stop (slice S1, file 8).
  *
  * The CLI process is short-lived; the daemon is not. `ensureDaemon` is the
  * whole cold-start/warm path from tech-doc §1.4. The lock exists because Q10
@@ -118,9 +117,10 @@ export function interpreterArgs(entry) {
  * It arrived in 20.6.0 (backported to 18.19.0); below that the spelling is
  * `--loader`, and passing `--import` is a bad option that kills the daemon at
  * startup — inside a `READY_TIMEOUT_MS = 20 s` wait whose only diagnosis is a
- * line in `daemon.log`. `package.json` declares `engines.node >= 20.0.0`, which
- * includes 20.0–20.5, so the flag cannot be unconditional. `tsx` gates its own
- * child the same way and this mirrors it.
+ * line in `daemon.log`. `engines.node` names a higher floor, but this function answers for
+ * whatever interpreter the daemon is actually started with — a machine with several Nodes
+ * can hand `--import` to an older one — so the flag cannot be unconditional. `tsx` gates
+ * its own child the same way and this mirrors it.
  */
 export function supportsImportFlag(nodeVersion = process.versions.node) {
     const [major = 0, minor = 0] = nodeVersion.split('.').map(Number);

package/dist/services/web/playwright-loader.js

@@ -1,5 +1,4 @@
 /**
- * Playwright resolution shim (slice S1, file 9; S3 hardened the scan).
  *
  * `playwright` is deliberately NOT a dependency (PRD non-goal): it is fetched
  * by `npx --package playwright@<pin>`. That has one sharp edge, verified on

package/dist/services/web/playwright-types.d.ts

@@ -1,6 +1,5 @@
 /**
  * The structural slice of the Playwright API this feature actually calls
- * (slice S1, file 9).
  *
  * Split out of `playwright-loader.ts` to keep the loader under the
  * 300-raw-line file cap — types only, no resolution or admission behaviour

package/dist/services/web/snapshot-pruner.js

@@ -1,5 +1,4 @@
 /**
- * ARIA snapshot pruner (slice S1, AC2 — the mechanism).
  *
  * Pure and browser-free by design (tech-doc §4.2): it operates on the object
  * tree `locator.ariaSnapshotJSON()` returns, so it is fully unit-testable with

package/dist/services/web/untrusted-envelope.d.ts

@@ -1,5 +1,4 @@
 /**
- * UNTRUSTED page-content envelope (slice S1, AC4 / R4).
  *
  * This MITIGATES prompt injection from page content; it does not solve it. No
  * string in this module (or in any help text, comment, or warning built on it)

package/dist/services/web/web-artifact-paths.js

@@ -1,5 +1,4 @@
 /**
- * Canonical path resolvers for the `peaks web` artifact tree (slice S1, AC1).
  *
  * What is actually guaranteed here, and what is not:
  *

package/dist/services/web/web-client.d.ts

@@ -1,5 +1,4 @@
 /**
- * Loopback HTTP client for the `peaks web` daemon (slice S1, file 6).
  *
  * The CLI layer never speaks HTTP itself: this class is the only thing it
  * knows how to talk to, so every transport concern (bearer token, timeouts,