peaks-loop 4.1.1 → 4.1.2

package/dist/cli/commands/cron-scheduler-persist.d.ts

@@ -1,5 +1,4 @@
 /**
- * The ONE writer of `lastRunAt` in this repo — rid `2026-10-01-cron-last-run-at-01`
  * (backlog §2.24), repair cycle 1 (review F1/F4/F5). Lives in its own file because
  * `cron-commands.ts` sits at 287 of its 300 raw-line cap and
  * `cron-scheduler-commands.ts` is already over its own; the rule below is small
@@ -23,7 +22,6 @@
  * invocations across 6 ticks** for one entry with `intervalMs` 86,400,000 at the
  * 60,000 ms daemon period — a 1440× rate error against the declared interval, and the
  * rate half of
- * `.peaks/docs/diagnosis-2026-10-01-worktree-list-population.md` §9. The same
  * test observes **1** once the write-back below runs.
  *
  * THE RULE (persist AFTER the run, from the record's `finishedAt`):
@@ -32,8 +30,6 @@
  *      exactly its own `intervalMs` and not one ms longer;
  *   2. a run carrying `killed: true` does NOT advance it, in EITHER entry point.
  *      Work cut off mid-flight is not a day's work, so the task stays due and is
- *      retried. What that costs is NOT uniform across platforms, and F3 of the
- *      review is the reason this paragraph is platform-shaped instead of global:
  *      - win32: the only fire shape that reaches `killed: true` here is the exec
  *        timeout (`cron-commands.ts:178-185`, spawnSync's `error.code ===
  *        'ETIMEDOUT'` branch), and that fire BLOCKS its caller for the whole
@@ -67,7 +63,6 @@
  *      running one…"); and entries `toScheduleEntry`
  *      (`cron-commands-schedule.ts:129-150`) REJECTS — a hand-edited entry missing
  *      `name`, say — are carried through as the raw JSON they were written as,
- *      appended after the parsed ones. F5 of the review: before this they were
  *      silently DELETED by the daemon's first write, which is data loss on a
  *      long-lived process nobody is watching. An unparseable entry with the same `id`
  *      as a parsed one is the one thing still dropped, because two entries under one

package/dist/cli/commands/cron-scheduler-persist.js

@@ -1,5 +1,4 @@
 /**
- * The ONE writer of `lastRunAt` in this repo — rid `2026-10-01-cron-last-run-at-01`
  * (backlog §2.24), repair cycle 1 (review F1/F4/F5). Lives in its own file because
  * `cron-commands.ts` sits at 287 of its 300 raw-line cap and
  * `cron-scheduler-commands.ts` is already over its own; the rule below is small
@@ -23,7 +22,6 @@
  * invocations across 6 ticks** for one entry with `intervalMs` 86,400,000 at the
  * 60,000 ms daemon period — a 1440× rate error against the declared interval, and the
  * rate half of
- * `.peaks/docs/diagnosis-2026-10-01-worktree-list-population.md` §9. The same
  * test observes **1** once the write-back below runs.
  *
  * THE RULE (persist AFTER the run, from the record's `finishedAt`):
@@ -32,8 +30,6 @@
  *      exactly its own `intervalMs` and not one ms longer;
  *   2. a run carrying `killed: true` does NOT advance it, in EITHER entry point.
  *      Work cut off mid-flight is not a day's work, so the task stays due and is
- *      retried. What that costs is NOT uniform across platforms, and F3 of the
- *      review is the reason this paragraph is platform-shaped instead of global:
  *      - win32: the only fire shape that reaches `killed: true` here is the exec
  *        timeout (`cron-commands.ts:178-185`, spawnSync's `error.code ===
  *        'ETIMEDOUT'` branch), and that fire BLOCKS its caller for the whole
@@ -67,7 +63,6 @@
  *      running one…"); and entries `toScheduleEntry`
  *      (`cron-commands-schedule.ts:129-150`) REJECTS — a hand-edited entry missing
  *      `name`, say — are carried through as the raw JSON they were written as,
- *      appended after the parsed ones. F5 of the review: before this they were
  *      silently DELETED by the daemon's first write, which is data loss on a
  *      long-lived process nobody is watching. An unparseable entry with the same `id`
  *      as a parsed one is the one thing still dropped, because two entries under one

package/dist/cli/commands/dashboard-summary.d.ts

@@ -1,5 +1,4 @@
 /**
- * rid-030 F-direction: `peaks dashboard summary --since <duration>`.
  *
  * Read-only 5-metric surface derived from raw observability events
  * (cycle / token / dispatch / compact / monotonic-trigger). Distinct

package/dist/cli/commands/dispatch-commands.d.ts

@@ -3,7 +3,6 @@ import { type ProgramIO } from '../cli-helpers.js';
 export declare function registerDispatchCommand(parent: Command, io: ProgramIO): void;
 /**
  * 2.7.0 slice-dag-dispatcher MVP — see `dispatch-from-dag.ts`.
- * The function was pulled out of this file in slice 2026-06-23-audit-3rd
  * #7 to honor the 800-line file cap and isolate the three heavy
  * module loads (slice-dag / dag-orchestrator / contract-store) to the
  * --from-dag codepath only.

package/dist/cli/commands/dispatch-commands.js

@@ -1,15 +1,11 @@
 /**
- * `peaks sub-agent dispatch <role> ...` — slice 2026-06-07-sub-agent-context-governance.
  *
- * Pulled out of `sub-agent-commands.ts` (slice 2026-06-23-audit-p0-split) to
  * honor the 800-line file cap (Karpathy #2 Simplicity First). The single
  * `dispatch` action lives here; the `--from-dag` sibling was further split
- * into `dispatch-from-dag.ts` (slice 2026-06-23-audit-3rd #7) because the
  * two paths share no logic and the `--from-dag` codepath loads three heavy
  * modules on first call (slice 9 perf) that the warm-path single-dispatch
  * never touches.
  *
- * Skill-first / CLI-auxiliary red line (PB-4 / AC-19/20): this command is
  * a primitive that the peaks-code / peaks-rd / peaks-qa SKILL.md compose.
  * Users do NOT invoke it directly; the --help text and dispatch
  * envelope's `nextActions` reinforce the point.
@@ -79,7 +75,6 @@ export function registerDispatchCommand(parent, io) {
         .option('--graph-node <id>', 'graph node id this dispatch binds to (default: a node is provisioned on demand)')
         .option('--workflow-id <id>', 'workflow id the graph node belongs to (defaults to derived from session)')
         .option('--graph-ref <ref>', 'graphRef (defaults to graphs/<workflow-id>.json)')
-        // rid-001 detached sub-agent dispatch: 4 new options. Default
         // mode is `in-process` so the 106+ existing dispatch call sites
         // keep their path byte-identical. The detached branch below
         // fires only when --mode detached is explicitly passed.
@@ -87,7 +82,6 @@ export function registerDispatchCommand(parent, io) {
         .option('--vendor <vendor>', 'target vendor CLI for --mode detached (claude | codex | copilot). Ignored in the default in-process path.')
         .option('--no-throttle', 'rid-001 detached: user-overrides ResourceBudgetGuard when concurrent fan-out exceeds max-concurrent (user accepts risk; surfaces as warning)')
         .option('--max-concurrent <n>', 'rid-001 detached: override the per-tenant max concurrent budget (default 8). Effective in both detached and in-process paths.')
-        // F5 follow-up (sediment 2026-08-11-rid-001-redo-fake-green-recovery-closure
         // §Lesson 1): the RD sub-agent's fake-green failure mode was that it
         // claimed "5/5 reachability tests PASS" while the files were never
         // on disk. `--must-ls-files <glob>` is the anti-fake-green gate:
@@ -98,7 +92,6 @@ export function registerDispatchCommand(parent, io) {
         // "completed" claim. Absent → old behavior is preserved.
         .option('--must-ls-files <glob>', 'F5: anti-fake-green gate. Run `git ls-files <glob>` upfront; surface the result in the envelope as `mustLsFilesVerification: { path, exists, files }`; prepend a must_ls_files enforcement block to the sub-agent prompt. Absent → unchanged behavior.')).action(async (role, options) => {
         const asJson = options.json === true;
-        // rid-001 detached sub-agent dispatch: when --mode detached is
         // explicitly requested, lazy-import the detached handler and short-
         // circuit before the warm-path in-process pipeline runs. Branch
         // lives in the existing action handler (NOT a sibling `peaks
@@ -234,7 +227,6 @@ export function registerDispatchCommand(parent, io) {
         }
         try {
             const projectRoot = options.project ?? process.cwd();
-            // Slice 2026-06-26-unknown-sid-fallback-fix: when --session-id is not
             // passed, auto-resolve the active peaks session id from
             // `.peaks/_runtime/session.json` (or PEAKS_SESSION_ID env var) so
             // dispatch records land in `.peaks/_sub_agents/<real-sid>/` instead
@@ -247,7 +239,6 @@ export function registerDispatchCommand(parent, io) {
                 'unknown-sid';
             const rid = options.requestId ?? 'unknown-rid';
             const batchId = options.batchId ?? randomUUID();
-            // Slice 2026-07-29-worktree-l2-extended Part 2.C: --isolation worktree
             // auto-spawns a worktree lease and injects PEAKS_WORKTREE_LEASE_ID
             // into the sub-agent dispatch envelope. This is the bridge that
             // makes the lease-aware gate (Part 2.B) work for sub-agents:
@@ -272,7 +263,6 @@ export function registerDispatchCommand(parent, io) {
                     return;
                 }
                 if (options.isolation === 'container') {
-                    // Slice 2026-07-29-worktree-l2-extended Part 12: container
                     // isolation is now live (Part 8 contract was the
                     // bridge; Part 12 is the runtime). Shell out to
                     // `peaks container spawn` to run `docker run` and
@@ -330,7 +320,6 @@ export function registerDispatchCommand(parent, io) {
                     }
                 }
                 else if (options.isolation === 'vm') {
-                    // Slice 2026-07-29-worktree-l2-extended Part 25: the
                     // VM isolation mode is the L4 follow-up to L4 container.
                     // The CLI contract is shipped (--isolation vm is accepted
                     // by the dispatch parser and reflected in the envelope's
@@ -391,34 +380,30 @@ export function registerDispatchCommand(parent, io) {
                 process.exitCode = 1;
                 return;
             }
-            // Slice 2026-07-22-orchestrator-memory-preflight (Task 5): prepend the
             // memory preflight block (or silently skip when unavailable) via the
             // pure-function builder.
             const preflightService = new MemoryPreflightService(projectRoot, projectPrefs);
-            // Slice 2026-09-09-memory-retrieval: rank the injected memory by the
             // task at hand (role + first line of the brief), not the bare role.
             const memoryBlock = await preflightService.fetchBlock(deriveMemoryQuery(role, options.prompt));
-            // Slice 2026-09-03-codegraph-preread (Option A): pre-dispatch
             // codegraph preflight for RD planning. BEFORE the RD sub-agent's
-            // prompt is composed, ensure the codegraph index exists (init +
-            // index best-effort when `.codegraph/` is absent; skip when already
-            // fresh) and read a BOUNDED project-structure summary. The block is
-            // only requested for the `rd` role — other roles keep the legacy
-            // prompt byte-identical. Fail-soft: any codegraph failure degrades
-            // to a null block (builder renders the "codegraph unavailable" note)
-            // and the dispatch proceeds; we never hard-block RD dispatch here.
+            // prompt is composed, ensure the index exists (init + index best-effort
+            // when `.codegraph/` is absent) and read a BOUNDED structure summary.
+            // `rd` only — other roles keep the legacy prompt byte-identical.
+            // Fail-soft: any failure degrades and dispatch proceeds. On failure the
+            // preflight's NOTE — the upstream cause — travels as the same value as
+            // the block, so the reason cannot be dropped while the block survives.
+            // The old `block : null` dropped it, so every degraded dispatch read as success.
             let codegraphBlock;
             if (role === 'rd') {
                 try {
                     const { buildCodegraphPreflightBlock } = await import('../../services/codegraph/codegraph-preflight-service.js');
                     const preflight = await buildCodegraphPreflightBlock(projectRoot);
-                    codegraphBlock = preflight.available ? preflight.block : null;
+                    codegraphBlock = preflight.available ? preflight.block : preflight.note;
                 }
-                catch {
-                    codegraphBlock = null; // fail-soft: never block RD dispatch
+                catch (error) {
+                    codegraphBlock = `codegraph preflight threw: ${getErrorMessage(error)}`;
                 }
             }
-            // Slice 2026-09-06-ui-lib-dispatch-priority: surface the detected
             // component library (+ CSS framework + build tool) in the RD/UI
             // dispatch system prompt so the sub-agent prefers the library over
             // hand-rolled native DOM. Only injected for frontend-generating roles
@@ -440,7 +425,6 @@ export function registerDispatchCommand(parent, io) {
             if (role === 'rd' || role === 'prd') {
                 freshContextBlock = readFreshContextBlock(projectRoot, sid);
             }
-            // Slice 2026-07-29-context-evaluation-accuracy: capture the
             // authoritative context-fill probe before composing the
             // dispatch prompt. The probe is token-counted (IDE adapter's
             // `compact` env-var), not a byte estimate. The composer
@@ -465,7 +449,6 @@ export function registerDispatchCommand(parent, io) {
                 // "no probe available" hint instead of failing the
                 // dispatch.
             }
-            // Slice 2026-09-10-dispatch-token-and-swarm §4: advisory background
             // capsule published by the orchestrator via `peaks sub-agent share`.
             // Absent capsule → no pointer and no precedence line (byte-identical
             // legacy prompt).
@@ -474,7 +457,6 @@ export function registerDispatchCommand(parent, io) {
                 taskTitle: role,
                 taskBody: options.prompt,
                 memoryBlock,
-                // 2026-09-10-dispatch-block-d (Option D): the composer owns the ONE
                 // unified Test Tool Detection injection for every role.
                 contextProbe,
                 // exactOptionalPropertyTypes: only set codegraphBlock when the rd
@@ -525,7 +507,6 @@ export function registerDispatchCommand(parent, io) {
             // file-existence verification as the LLM's FIRST action (before
             // any "completed"/"PASS" claim). When the flag is absent the
             // field is `null` and no block is injected — old call sites
-            // see no behavior change (rid-001 fake-green Lesson 1).
             let mustLsFilesVerification = null;
             let mustLsFilesBlock = '';
             if (typeof options.mustLsFiles === 'string' && options.mustLsFiles.length > 0) {
@@ -543,7 +524,6 @@ export function registerDispatchCommand(parent, io) {
                         `if the file does not exist, your verdict MUST be \`status: "blocked"\` with reason "must_ls_files_failed". Do NOT silently skip this step.\n`;
             }
             const effectivePrompt = `${memoryAugmentedBody}${isolationBlock}${mustLsFilesBlock}`;
-            // Slice F2 (rid-f2-ac1-wiring): deprecated reviewer slots are accepted
             // + rerouted here, never refused — rationale on the helper itself.
             const warnings = [...decision.warnings, ...deprecatedReviewerWarnings(role)];
             let toolCall;
@@ -580,7 +560,6 @@ export function registerDispatchCommand(parent, io) {
                             }
                         });
                     }
-                    // Slice 2026-08-01-subagent-merge-and-e2e (Task 8): stamp the
                     // two Playwright profile-isolation env vars so the sub-agent's
                     // browser MCP session lands in a deterministic
                     // `.peaks/_runtime/<sid>/pw-profiles/<dispatchId>/` directory
@@ -703,13 +682,11 @@ export function registerDispatchCommand(parent, io) {
                 graphRef: graphBinding.graphRef,
                 toolCall,
                 batchId,
-                // Slice 2026-07-29-worktree-l2-extended Part 3.A: persist the
                 // lease id on the dispatch record so the finalize-time
                 // release hook (markCompleted / heartbeat --status done) can
                 // auto-fire `peaks worktree release` when the sub-agent
                 // completes. Null when --isolation was not requested.
                 leaseId,
-                // Slice 2026-07-29-worktree-l2-extended Part 7: stamp the
                 // ISO timestamp when the isolation mode was set up. Null
                 // when --isolation was not requested. The dashboard reads
                 // this directly off the dispatch record to compute
@@ -740,13 +717,11 @@ export function registerDispatchCommand(parent, io) {
                 : [];
             const orchestratorVisibleHint = `⏳ Spawning sub-agent via Task tool: ${role} for rid=${rid}, batch-id=${batchId} (ETA ~${expectedCompletionSeconds}s)`;
             printResult(io, ok('sub-agent.dispatch', {
-                // Slice 2026-06-23-audit-4th #E1: every CLI envelope carries
                 // an envelopeVersion marker so consumers can detect contract
                 // changes (the previous #4 dropped `data.prompt` silently).
                 envelopeVersion: '2.3.0',
                 role,
                 ide: adapter.subAgentDispatcher.label,
-                // Slice 2026-06-23-audit-3rd #4: do NOT echo `prompt` in stdout.
                 // Prompts can carry user content (sometimes test credentials /
                 // internal URLs) that has no business landing in shell history,
                 // log aggregators, or tmux scrollback. The dispatch record on
@@ -783,7 +758,6 @@ export function registerDispatchCommand(parent, io) {
                 // spawning the sub-agent. Null when the flag is absent.
                 mustLsFilesVerification
             }, warnings, nextActions), asJson);
-            // Slice 2026-06-23-audit-4th #B1: structured log on success path.
             // Best-effort: writeLogEntry swallows its own errors (logger.ts:155-159),
             // so a full disk or missing ~/.peaks/logs/ dir never blocks the dispatch.
             try {
@@ -818,7 +792,6 @@ export function registerDispatchCommand(parent, io) {
 }
 /**
  * 2.7.0 slice-dag-dispatcher MVP — see `dispatch-from-dag.ts`.
- * The function was pulled out of this file in slice 2026-06-23-audit-3rd
  * #7 to honor the 800-line file cap and isolate the three heavy
  * module loads (slice-dag / dag-orchestrator / contract-store) to the
  * --from-dag codepath only.

package/dist/cli/commands/dispatch-from-dag.js

@@ -1,5 +1,4 @@
 /**
- * `peaks sub-agent dispatch --from-dag <file>` — slice 2026-06-23-audit-3rd #7.
  *
  * Pulled out of `dispatch-commands.ts` to honor the 800-line file cap
  * (Karpathy #2 Simplicity First). The single-dispatch action stays in
@@ -37,7 +36,6 @@ export async function runDispatchFromDag(role, options, asJson, io) {
     if (!options.fromDag)
         return;
     const projectRoot = options.project ?? process.cwd();
-    // Slice 2026-06-26-unknown-sid-fallback-fix: see dispatch-commands.ts.
     // Auto-resolve sid from .peaks/_runtime/session.json before falling back.
     const sid = options.sessionId ??
         process.env.PEAKS_SESSION_ID ??
@@ -136,7 +134,6 @@ export async function runDispatchFromDag(role, options, asJson, io) {
     // end-to-end, but they are NOT surfaced in the CLI envelope (the LLM
     // sees them only after re-invoking with fresh level-1 contracts).
     const firstLevelIds = new Set(levelArr[0] ?? []);
-    // Slice 2026-09-10-dispatch-token-and-swarm §3: when EVERY first-level
     // node declares `files`, refine the level into file-overlap waves so the
     // LLM fans out without serializing on a shared file. Emitted additively
     // in the envelope; the topological dispatch flow itself is unchanged.
@@ -244,7 +241,6 @@ export async function runDispatchFromDag(role, options, asJson, io) {
         return;
     }
     printResult(io, ok('sub-agent.dispatch', {
-        // Slice 2026-06-23-audit-4th #E1: envelopeVersion marker
         envelopeVersion: '2.1.0',
         role,
         ide: dispatcher.label,

package/dist/cli/commands/doctor/invoke-from-code.js

@@ -3,7 +3,6 @@
  * Contract surface for peaks-code Step 11 → peaks-doctor bridge.
  * Writes proposal stub to .peaks/_runtime/<sid>/doctor/proposal.md.
  * Real LLM call is delegated to peaks-doctor (Phase D Task 24 detail).
- * Spec: docs/superpowers/specs/2026-08-10-peaks-detached-sub-agent-design.md §3.6
  */
 import { mkdirSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';

package/dist/cli/commands/e2e-verify.d.ts

@@ -1,7 +1,6 @@
 /**
  * e2e-verify — `peaks e2e verify --slice <rid>` CLI for the merged slice.
  *
- * Slice 2026-08-01-subagent-merge-and-e2e (Task 10). The parent session
  * calls this command once after the merge-back step. The CLI delegates
  * to `runE2EVerify`, which uses the e2e-fixtures reader
  * (`src/services/dispatch/e2e-fixtures.ts`) to enumerate the fixtures

package/dist/cli/commands/ecc-commands.d.ts

@@ -10,7 +10,6 @@
  * `repository.url` is `git+https://github.com/affaan-m/ECC.git`).
  *
  *   - `peaks ecc install` — land/refresh the copy. Idempotent; prunes agents the
- *     installed package no longer ships.
  *   - `peaks ecc status` — package version + what landed and when.
  *   - `peaks ecc ls` — the roster with declared name + description (D-009
  *     fallback to filename + first body line when frontmatter is malformed).

package/dist/cli/commands/evolution-commands.d.ts

@@ -19,7 +19,6 @@
  * are LLM-supplied; the user is NEVER asked to type them.
  *
  * Defense in depth: the EvolutionService enforces the ratchet
- * rules (AC-8 / AC-10 / AC-11); the CLI only translates flags
  * into the service payload.
  */
 import type { Command } from 'commander';

package/dist/cli/commands/evolution-commands.js

@@ -19,7 +19,6 @@
  * are LLM-supplied; the user is NEVER asked to type them.
  *
  * Defense in depth: the EvolutionService enforces the ratchet
- * rules (AC-8 / AC-10 / AC-11); the CLI only translates flags
  * into the service payload.
  */
 import { existsSync, mkdirSync } from 'node:fs';

package/dist/cli/commands/feedback-commands.d.ts

@@ -1,5 +1,4 @@
 /**
- * v2.15.0 slice 002 — AC-3: feedback promotion CLI.
  *
  *   - `peaks feedback promote <memory-file> [--layer A|B|C] [--dry-run]`
  *   - `peaks feedback check-unpromoted --project <path> [--strict]`

package/dist/cli/commands/feedback-commands.js

@@ -1,5 +1,4 @@
 /**
- * v2.15.0 slice 002 — AC-3: feedback promotion CLI.
  *
  *   - `peaks feedback promote <memory-file> [--layer A|B|C] [--dry-run]`
  *   - `peaks feedback check-unpromoted --project <path> [--strict]`
@@ -91,7 +90,6 @@ export function registerFeedbackCommands(program, io) {
                 projectRoot,
                 dryRun: false
             });
-            // rid 2026-09-14-gate-h-promotion: report what was written, not what
             // the stub wished for. A promotion whose layer artifact is absent is
             // recorded but NOT effective, and says so with a non-zero exit.
             const notes = [

package/dist/cli/commands/fixture-commands.d.ts

@@ -1,5 +1,4 @@
 /**
- * v2.14.0 G1 AC-1.4 — `peaks fixture capture` CLI surface.
  *
  * Producer-side CLI for the G1 fixture-replay anti-fake-green test
  * suite. Captures a real envelope artifact from
@@ -16,7 +15,6 @@
  *                        --out tests/fixtures/replay
  *
  * Why a CLI (not just a service function):
- *   - AC-1.4 mandates the CLI as the producer. A1.4 honesty test:
  *     every fixture under `tests/fixtures/replay/` MUST have a
  *     `producer: 'peaks-fixture-capture-cli'` in its `fixture.meta.json`
  *     and a `capturedAt` timestamp within a window where the CLI was

package/dist/cli/commands/fresh-context-commands.d.ts

@@ -1,6 +1,5 @@
 /**
  * `peaks fresh-context preflight` CLI — deterministic trigger scan for the
- * search-first preflight (slice 2026-09-07-search-first-preflight).
  *
  * This command is the shared, deterministic surface every peaks-* orchestrator
  * calls at orchestration-start, BEFORE the first planning action, to decide

package/dist/cli/commands/gate-commands-enforce.d.ts

@@ -38,7 +38,6 @@ export declare function resolveToolMatcher(parsedStdin: unknown): string;
  * call was denied (a hard block has already been emitted and the handler must stop) and `false`
  * when the flow should continue to the SOP gate. `Other` tool kinds are not gated at all.
  *
- * slice 2026-07-27-worktree-user-auth: BEFORE the SOP gate runs, check the worktree authorization
  * gate. The worktree gate is narrower than the SOP gate (it only inspects a small set of
  * worktree-mutating operations) and is fail-CLOSED. The two layers are complementary: SOP gates
  * decide "may this command run under this SOP's state", the worktree gate decides "did the user
@@ -62,7 +61,6 @@ export declare function emitAllowSkipped(io: ProgramIO, options: GateEnforceCliO
 /** Worktree gate allowed and this is not a Bash surface — allow without running the SOP gate. */
 export declare function emitAllowWorktree(io: ProgramIO, options: GateEnforceCliOptions): void;
 /**
- * PRD#2 (2026-06-16-fact-forcing-gate-format): a true SOP gate failure is a HARD block. emitBlock
  * writes the Claude Code permissionDecision:"deny" JSON to stdout (the hook's decision signal),
  * sets process.exitCode = 2 (Claude Code's block exit code), AND surfaces the reason to stderr so
  * the LLM sees it on the next turn. This prevents the previous behaviour where Claude Code wrapped
@@ -74,7 +72,6 @@ export declare function emitSopWarnings(io: ProgramIO, decision: SopAllow): void
 /**
  * SOP gate allowed the command. --json mode emits the canonical envelope on stdout (the documented
  * contract for downstream tooling). The hook decision (allow/deny) is still signalled via
- * process.exitCode + the minimal `{}` on stdout in non-`--json` mode. Slice 2026-07-30-nightshift:
  * emitHint here was wrong — emitHint writes to stderr, but the AC5 contract expects the JSON
  * envelope on stdout. Switch to printResult(asJson=true).
  */

package/dist/cli/commands/gate-commands-enforce.js

@@ -87,7 +87,6 @@ function normalizeLeaseId(value) {
  * tool input — only "worktree" isolation is gated. For all other tool kinds the worktree gate is a
  * no-op.
  *
- * slice 2026-07-29-worktree-l2-extended Part 2.B: the gate consults the lease file referenced by
  * `PEAKS_WORKTREE_LEASE_ID` as a second authorization path when no `peaks worktree auth grant` is on
  * file. Dispatch (Part 2.C) injects the env var on every sub-agent spawn so worktree-mutating tool
  * calls from inside the sub-agent process auto-authorize via the lease instead of requiring a
@@ -113,7 +112,6 @@ function buildWorktreeAuthInput(options, toolKind, command, parsedStdin) {
  * call was denied (a hard block has already been emitted and the handler must stop) and `false`
  * when the flow should continue to the SOP gate. `Other` tool kinds are not gated at all.
  *
- * slice 2026-07-27-worktree-user-auth: BEFORE the SOP gate runs, check the worktree authorization
  * gate. The worktree gate is narrower than the SOP gate (it only inspects a small set of
  * worktree-mutating operations) and is fail-CLOSED. The two layers are complementary: SOP gates
  * decide "may this command run under this SOP's state", the worktree gate decides "did the user
@@ -171,7 +169,6 @@ export function emitAllowWorktree(io, options) {
     }
 }
 /**
- * PRD#2 (2026-06-16-fact-forcing-gate-format): a true SOP gate failure is a HARD block. emitBlock
  * writes the Claude Code permissionDecision:"deny" JSON to stdout (the hook's decision signal),
  * sets process.exitCode = 2 (Claude Code's block exit code), AND surfaces the reason to stderr so
  * the LLM sees it on the next turn. This prevents the previous behaviour where Claude Code wrapped
@@ -194,7 +191,6 @@ export function emitSopWarnings(io, decision) {
 /**
  * SOP gate allowed the command. --json mode emits the canonical envelope on stdout (the documented
  * contract for downstream tooling). The hook decision (allow/deny) is still signalled via
- * process.exitCode + the minimal `{}` on stdout in non-`--json` mode. Slice 2026-07-30-nightshift:
  * emitHint here was wrong — emitHint writes to stderr, but the AC5 contract expects the JSON
  * envelope on stdout. Switch to printResult(asJson=true).
  */

package/dist/cli/commands/gate-commands.js

@@ -36,14 +36,12 @@ async function readHookPayload() {
     });
 }
 /**
- * Slice 2026-07-29-windows-console-flash Part 46: actively exit the process when the gate-enforce
  * handler returns. The default behavior is to wait for stdin EOF before exiting, but the hook's
  * stdin pipe may not close promptly (the parent can keep the handle open even after it has finished
  * reading the JSON decision), which causes 4 Node.js processes to accumulate in the user's task
  * manager. An explicit process.exit here forces the gate process to release all handles and exit
  * immediately.
  *
- * Slice 2026-07-30-nightshift: gate the `process.exit` on being invoked as a real CLI hook (no
  * PEAKS_HOOK_STDIN test seam, no PEAKS_TEST_SEAM env var). The test harness calls `runCommand`
  * which invokes the same action handler in process — calling `process.exit` inside the test would
  * kill the vitest runner before assertions complete. The `process.exitCode` set above is sufficient

package/dist/cli/commands/governance-classify-contract-commands.d.ts

@@ -1,5 +1,4 @@
 /**
- * rid-007 Family 1 merge: contract-commands + classify-classify-commands.
  *
  * Pre-merge originals (now deleted):
  *   - src/cli/commands/contract-commands.ts     (167 lines)
@@ -10,10 +9,8 @@
  * only — no behavior change. `autoRegisterAllCommands` discovers both
  * exports from this single file.
  *
- * Why one file: the RD slice rid-007 user-confirmed one-family merge
  * minimum; Family 1 is the cleanest demonstration because both inputs
  * sit under 200 lines and the merged file lands at ~360 lines — well
- * below the 400-line AC-9 sanity guard and the 800-line scan gate.
  */
 import type { Command } from 'commander';
 import { type ProgramIO } from '../cli-helpers.js';

package/dist/cli/commands/governance-classify-contract-commands.js

@@ -1,5 +1,4 @@
 /**
- * rid-007 Family 1 merge: contract-commands + classify-classify-commands.
  *
  * Pre-merge originals (now deleted):
  *   - src/cli/commands/contract-commands.ts     (167 lines)
@@ -10,10 +9,8 @@
  * only — no behavior change. `autoRegisterAllCommands` discovers both
  * exports from this single file.
  *
- * Why one file: the RD slice rid-007 user-confirmed one-family merge
  * minimum; Family 1 is the cleanest demonstration because both inputs
  * sit under 200 lines and the merged file lands at ~360 lines — well
- * below the 400-line AC-9 sanity guard and the 800-line scan gate.
  */
 // ===========================================================================
 // Shared imports (consolidated; both originals pulled names from these
@@ -76,7 +73,6 @@ export function registerContractCommands(program, io) {
         .option('--completed-at <iso>', 'ISO 8601 timestamp; defaults to now()')).action((options) => {
         const asJson = options.json === true;
         const projectRoot = options.project ?? process.cwd();
-        // Slice 2026-06-26-unknown-sid-fallback-fix: see dispatch-commands.ts.
         const sid = options.sessionId ??
             process.env.PEAKS_SESSION_ID ??
             getCurrentSessionId(projectRoot) ??

package/dist/cli/commands/heartbeat-commands-action.js

@@ -27,7 +27,6 @@ import { appendHeartbeat, setStage, tryAutoReleaseLease } from '../../services/d
 import { assertSafeDispatchRecordPath } from '../../services/security/safe-settings-path.js';
 import { writeLogEntry } from '../../services/log/logger.js';
 import { failHeartbeat, heartbeatErrorCode, heartbeatErrorNextActions, resolveHeartbeatStage, validateHeartbeatArguments } from './heartbeat-commands-validation.js';
-// Slice 2026-07-29-worktree-l2-extended Part 3.A.2: the statuses that end a
 // dispatch. Hoisted out of the action body — a constant set is the same set on
 // every call, and its position in the sequence (after printResult) is unchanged.
 const TERMINAL_HEARTBEAT_STATUSES = new Set([
@@ -37,7 +36,6 @@ const TERMINAL_HEARTBEAT_STATUSES = new Set([
     'no-execution'
 ]);
 /**
- * Slice 2026-07-29-worktree-l2-extended Part 24: the heartbeat envelope
  * surfaces a `leaseHint` field when the dispatch owns a lease. The hint is a
  * one-line reminder for the sub-agent that the lease is the L2 surface it
  * should clean up before exiting (or, per Part 3.A.2, the auto-release hook
@@ -53,7 +51,6 @@ function leaseHintFor(result) {
 /** The success envelope's payload, field for field, exactly as the CLI printed it. */
 function heartbeatSuccessEnvelope(recordPath, result) {
     return {
-        // Slice 2026-06-23-audit-4th #E1: envelopeVersion marker
         // Part 24: bumped to 2.2.0 to advertise the new `leaseHint`
         // field; readers from 2.1.0 ignore the unknown field.
         envelopeVersion: '2.2.0',
@@ -66,7 +63,6 @@ function heartbeatSuccessEnvelope(recordPath, result) {
     };
 }
 /**
- * Slice 2026-07-29-worktree-l2-extended Part 3.A.2: when the heartbeat reports
  * a TERMINAL status (done / failed / cancelled / no-execution) AND the dispatch
  * owns a lease, fire the detached release. This is the common path: most
  * sub-agents finalize via heartbeat before the share-reducer calls
@@ -91,7 +87,6 @@ function releaseLeaseForTerminalHeartbeat(trustedRoot, status, result) {
         }
     }
 }
-/** Slice 2026-06-23-audit-4th #B1: structured log on success. */
 function logHeartbeatSuccess(recordPath, result) {
     try {
         writeLogEntry({
@@ -158,7 +153,6 @@ export function runHeartbeatAction(io, options) {
         return;
     }
     try {
-        // R-2 guard (slice 2026-06-23-audit-3rd): trust --project or process.cwd(),
         // NOT the --record path. deriveProjectRoot(recordPath) walked the path
         // itself, which let an attacker point --record at any other project's
         // .peaks/_sub_agents/ tree and slip past the guard. The relative()

package/dist/cli/commands/heartbeat-commands-validation.d.ts

@@ -38,7 +38,6 @@ export declare function failHeartbeat(io: ProgramIO, f: {
  */
 export declare function validateHeartbeatArguments(io: ProgramIO, asJson: boolean, options: HeartbeatActionOptions, recordPath: string): HeartbeatArgumentsCheck;
 /**
- * Slice 2026-07-29-dispatch-stall-governance / S5 (AC-5.2) — validate the
  * optional `--stage` against the bounded enum BEFORE the heartbeat write so the
  * caller gets a specific `INVALID_STAGE` error rather than a generic
  * `HEARTBEAT_ERROR`. An absent or empty flag is not an error: it yields
@@ -48,7 +47,6 @@ export declare function validateHeartbeatArguments(io: ProgramIO, asJson: boolea
  */
 export declare function resolveHeartbeatStage(io: ProgramIO, asJson: boolean, options: HeartbeatActionOptions, recordPath: string): HeartbeatStageCheck;
 /**
- * Slice 2026-06-23-audit-3rd #9: branch nextActions on `error.code` so
  * the LLM-side runner gets a specific hint instead of the generic
  * "see error message" fallback.
  */

package/dist/cli/commands/heartbeat-commands-validation.js

@@ -69,7 +69,6 @@ export function validateHeartbeatArguments(io, asJson, options, recordPath) {
     return { ok: true, progress };
 }
 /**
- * Slice 2026-07-29-dispatch-stall-governance / S5 (AC-5.2) — validate the
  * optional `--stage` against the bounded enum BEFORE the heartbeat write so the
  * caller gets a specific `INVALID_STAGE` error rather than a generic
  * `HEARTBEAT_ERROR`. An absent or empty flag is not an error: it yields
@@ -95,7 +94,6 @@ export function resolveHeartbeatStage(io, asJson, options, recordPath) {
     return { ok: true, stage: stageLabel };
 }
 /**
- * Slice 2026-06-23-audit-3rd #9: branch nextActions on `error.code` so
  * the LLM-side runner gets a specific hint instead of the generic
  * "see error message" fallback.
  */

package/dist/cli/commands/heartbeat-commands.d.ts

@@ -1,7 +1,6 @@
 /**
  * `peaks sub-agent heartbeat` — G6: append a heartbeat to a dispatch record.
  *
- * Pulled out of `sub-agent-commands.ts` (slice 2026-06-23-audit-p0-split)
  * to honor the 800-line file cap. The heartbeat is fire-and-forget; the
  * parent Dispatcher polls the record during the batch-sync wait and
  * renders a status line. Sub-agents should call this at least every

package/dist/cli/commands/heartbeat-commands.js

@@ -11,7 +11,6 @@ export function registerHeartbeatCommand(parent, io) {
         .requiredOption('--status <state>', 'queued | running | finalizing | done | failed | stale | cancelled | no-execution | never-started | unreadable')
         .requiredOption('--progress <pct>', 'integer 0-100')
         .option('--note <text>', 'free-form progress note (≤ 200 chars)')
-        // Slice 2026-07-29-dispatch-stall-governance / S5 (AC-5.2) —
         // optional --stage flag. The label is bounded (see
         // src/services/dispatch/stage-enum.ts); an unknown value is
         // rejected with INVALID_STAGE so the watch surface never