@desplega.ai/agent-swarm 2.7.2 → 2.7.3

package/dist/{work-objects-ftj4zw70.js → work-objects-x7rb53qn.js}

@@ -2,18 +2,22 @@ import {
   getAgentById2,
   getTaskById2,
   init_db3
-} from "./cli-txr0z97c.js";
+} from "./cli-wmhajw68.js";
 import {
+  isAdmittedSlackDelivery,
   slackTaskOutput,
   getTaskUrl
-} from "./cli-9jfty8px.js";
+} from "./cli-ktcdczth.js";
+import {
+  wasEventSeen
+} from "./cli-157ykn37.js";
 import {
   shouldBlockChannel2
-} from "./cli-6vq3ymqm.js";
-import"./cli-qy0z3mfj.js";
-import"./cli-b2rhbaty.js";
-import"./cli-10cp92df.js";
-import"./cli-t3npd8hm.js";
+} from "./cli-0tkm519n.js";
+import"./cli-9vttw9nz.js";
+import"./cli-pnm99spe.js";
+import"./cli-5ke7gxwr.js";
+import"./cli-ghfhn1qc.js";
 import"./cli-3ggwdtb0.js";
 import"./cli-e8xyjvfc.js";
 import"./cli-n0ysjjtv.js";
@@ -22,28 +26,27 @@ import"./cli-kvzgak7c.js";
 import"./cli-445c1vp7.js";
 import"./cli-jbgrwv4y.js";
 import"./cli-eny54typ.js";
-import"./cli-1xpr5992.js";
-import"./cli-qp6adcmw.js";
-import"./cli-p8yrsmfn.js";
-import"./cli-e19bgatr.js";
+import"./cli-kjha1q9k.js";
+import"./cli-e24w2mvk.js";
+import"./cli-10kjx0dm.js";
+import"./cli-jmk31131.js";
 import"./cli-qz93y3x5.js";
-import"./cli-jmcf8cnz.js";
-import"./cli-mzgppb7q.js";
-import"./cli-g9ypd5en.js";
-import"./cli-2qbmjfta.js";
-import"./cli-s7cm1927.js";
+import"./cli-ja369zab.js";
+import"./cli-a0w50zw9.js";
+import"./cli-z52gq55b.js";
+import"./cli-z6219sd3.js";
+import"./cli-0xzbk52h.js";
 import"./cli-3h26v7yj.js";
 import"./cli-vpq0n13a.js";
-import"./cli-942pp3bc.js";
-import"./cli-7xsq63pe.js";
+import"./cli-54ax65rn.js";
 import {
   isUserAllowed2
-} from "./cli-2m2p3snc.js";
+} from "./cli-mmf43vcp.js";
 import"./cli-13p25grh.js";
 import"./cli-0adyhvq2.js";
-import"./cli-9jn9cj0q.js";
+import"./cli-v9jk2k63.js";
 import"./cli-rycdaj0a.js";
-import"./cli-2cj8fqv1.js";
+import"./cli-kjcdzea8.js";
 import {
   isEnvFlagEnabled,
   init_env_flag
@@ -125,9 +128,11 @@ async function getDetails(event, client) {
   };
 }
 function registerWorkObjectHandlers(app) {
-  app.event("entity_details_requested", async ({ event, client, logger }) => {
+  app.event("entity_details_requested", async ({ event, body, client, logger }) => {
     if (!isEnvFlagEnabled("SLACK_WORK_OBJECTS_ENABLED", false))
       return;
+    if (!isAdmittedSlackDelivery() && wasEventSeen(body?.event_id))
+      return;
     let details;
     try {
       details = await getDetails(event, client);

package/dist/{worker-859fk25k.js → worker-7f3khgn0.js}

@@ -1,69 +1,69 @@
 import"./cli-qz93y3x5.js";
 import {
   getEnabledCapabilities
-} from "./cli-qy0z3mfj.js";
-import"./cli-txr0z97c.js";
-import"./cli-jmcf8cnz.js";
-import"./cli-mzgppb7q.js";
-import"./cli-p8yrsmfn.js";
-import"./cli-e19bgatr.js";
-import"./cli-qp6adcmw.js";
+} from "./cli-9vttw9nz.js";
+import"./cli-wmhajw68.js";
+import"./cli-ja369zab.js";
+import"./cli-a0w50zw9.js";
+import"./cli-10kjx0dm.js";
+import"./cli-jmk31131.js";
+import"./cli-e24w2mvk.js";
 import"./cli-eny54typ.js";
-import"./cli-b2rhbaty.js";
-import"./cli-10cp92df.js";
-import"./cli-t3npd8hm.js";
+import"./cli-pnm99spe.js";
+import"./cli-5ke7gxwr.js";
+import"./cli-ghfhn1qc.js";
 import"./cli-3ggwdtb0.js";
 import"./cli-e8xyjvfc.js";
-import"./cli-9jfty8px.js";
-import"./cli-6vq3ymqm.js";
+import"./cli-ktcdczth.js";
+import"./cli-0tkm519n.js";
 import"./cli-n0ysjjtv.js";
 import"./cli-2nf3b08t.js";
 import"./cli-kvzgak7c.js";
 import"./cli-445c1vp7.js";
 import"./cli-jbgrwv4y.js";
-import"./cli-1xpr5992.js";
-import"./cli-s7cm1927.js";
-import"./cli-g9ypd5en.js";
-import"./cli-2qbmjfta.js";
+import"./cli-kjha1q9k.js";
+import"./cli-0xzbk52h.js";
+import"./cli-z52gq55b.js";
+import"./cli-z6219sd3.js";
 import"./cli-3h26v7yj.js";
 import"./cli-vpq0n13a.js";
 import"./cli-8wd3mbyj.js";
 import"./cli-vqgnyh76.js";
 import"./cli-77cd6gy8.js";
-import"./cli-femw4q81.js";
+import"./cli-6151a7dr.js";
 import {
   runAgent
-} from "./cli-bfbpvccx.js";
+} from "./cli-8a1k6mat.js";
 import"./cli-4887xyd1.js";
 import"./cli-9cctx1tn.js";
 import"./cli-cr3k93hd.js";
 import"./cli-jc1g9ndz.js";
-import"./cli-fa4kxxx3.js";
-import"./cli-vjcj9k2p.js";
+import"./cli-ct5920jb.js";
+import"./cli-2h0rfmqk.js";
 import"./cli-5xbma5yx.js";
 import"./cli-d82btycs.js";
 import"./cli-0726awxw.js";
-import"./cli-z8a4mfz1.js";
-import"./cli-c18941tx.js";
+import"./cli-aqp59jmv.js";
+import"./cli-8ch3b2r7.js";
 import"./cli-4bd1rck6.js";
 import"./cli-h3e7bhvn.js";
 import"./cli-prcyzecg.js";
 import"./cli-dehgvj25.js";
 import"./cli-kr5tjjtz.js";
-import"./cli-exd52qn4.js";
-import"./cli-rs2s1t05.js";
+import"./cli-mcmpbpcc.js";
+import"./cli-9fk56y8c.js";
 import"./cli-9y354g3j.js";
-import"./cli-g0zc1b40.js";
-import"./cli-hq9hd4hp.js";
+import"./cli-0zae6bs6.js";
+import"./cli-xz6qjdqj.js";
 import"./cli-0n39ee9n.js";
 import"./cli-5z6xz9xs.js";
-import"./cli-rs59z1qx.js";
+import"./cli-07pcqwaj.js";
 import"./cli-4zsenjhy.js";
 import"./cli-13p25grh.js";
 import"./cli-0adyhvq2.js";
-import"./cli-9jn9cj0q.js";
+import"./cli-v9jk2k63.js";
 import"./cli-rycdaj0a.js";
-import"./cli-2cj8fqv1.js";
+import"./cli-kjcdzea8.js";
 
 // src/commands/worker.ts
 var workerConfig = {

package/openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.1.0",
   "info": {
     "title": "Agent Swarm API",
-    "version": "2.7.2",
+    "version": "2.7.3",
     "description": "Multi-agent orchestration API for Claude Code, Codex, and Gemini CLI. Enables task distribution, agent communication, and service discovery.\n\nMCP tools are documented separately in [MCP.md](./MCP.md)."
   },
   "servers": [
@@ -1016,6 +1016,64 @@
           "reportedAt"
         ]
       },
+      "AgentSlackIcon": {
+        "oneOf": [
+          {
+            "type": "object",
+            "properties": {
+              "type": {
+                "type": "string",
+                "enum": [
+                  "emoji"
+                ]
+              },
+              "emoji": {
+                "type": "string",
+                "maxLength": 102,
+                "pattern": "^:[a-z0-9_+'-]+:$"
+              }
+            },
+            "required": [
+              "type",
+              "emoji"
+            ]
+          },
+          {
+            "type": "object",
+            "properties": {
+              "type": {
+                "type": "string",
+                "enum": [
+                  "url"
+                ]
+              },
+              "url": {
+                "type": "string",
+                "maxLength": 2048,
+                "format": "uri"
+              }
+            },
+            "required": [
+              "type",
+              "url"
+            ]
+          },
+          {
+            "type": "object",
+            "properties": {
+              "type": {
+                "type": "string",
+                "enum": [
+                  "app"
+                ]
+              }
+            },
+            "required": [
+              "type"
+            ]
+          }
+        ]
+      },
       "Agent": {
         "type": "object",
         "properties": {
@@ -1189,6 +1247,16 @@
               }
             ]
           },
+          "slackIcon": {
+            "oneOf": [
+              {
+                "$ref": "#/components/schemas/AgentSlackIcon"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
           "createdAt": {
             "type": "string",
             "format": "date-time"
@@ -11804,6 +11872,16 @@
                       }
                     ]
                   },
+                  "slackIcon": {
+                    "oneOf": [
+                      {
+                        "$ref": "#/components/schemas/AgentSlackIcon"
+                      },
+                      {
+                        "type": "null"
+                      }
+                    ]
+                  },
                   "changeSource": {
                     "type": "string"
                   },
@@ -23619,6 +23697,42 @@
         }
       }
     },
+    "/api/integrations/slack/app-icon": {
+      "get": {
+        "summary": "The Slack app's own avatar, shown on posts with no icon override",
+        "tags": [
+          "Integrations"
+        ],
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "`imageUrl` is null when Slack is off or the lookup fails.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "imageUrl": {
+                      "type": [
+                        "string",
+                        "null"
+                      ]
+                    }
+                  },
+                  "required": [
+                    "imageUrl"
+                  ]
+                }
+              }
+            }
+          }
+        }
+      }
+    },
     "/api/integrations/chat/status": {
       "get": {
         "summary": "Chat SDK channel status: enabled flag, Slack clash, per-adapter health and webhook URL.",
@@ -30586,7 +30700,7 @@
     "/status": {
       "get": {
         "summary": "Identity + setup readiness + live activity for the swarm dashboard",
-        "description": "Single source of truth consumed by the UI home page. Identity comes from SWARM_* envs; setup milestones each emit `unverified | configured | verified`; automations report `running | needs_setup` from the same runtime preflight used at dispatch; activity counts agents alive in the last 5 min, leads that can take work (status idle or busy), and tasks created in the last 24h; agent_fs reports whether AGENT_FS_API_URL is set, plus the Comb settings (COMB_ENABLED, the browser-facing agent-fs URL, the shared org and drive ids, and the agent-fs user id of the swarm service account); telemetry reports the effective ANONYMIZED_TELEMETRY opt-out state.",
+        "description": "Single source of truth consumed by the UI home page. Identity comes from SWARM_* envs; setup milestones each emit `unverified | configured | verified`; automations report `running | needs_setup` from the same runtime preflight used at dispatch; activity counts agents alive in the last 5 min, leads that can take work (status idle or busy), and tasks created in the last 24h; agent_fs reports whether AGENT_FS_API_URL is set, plus the Comb settings (whether Files is on and, when off, what is missing; the browser-facing agent-fs URL, the shared org and drive ids, and the agent-fs user id of the swarm service account); telemetry reports the effective ANONYMIZED_TELEMETRY opt-out state.",
         "tags": [
           "Status"
         ],
@@ -30820,6 +30934,12 @@
                             "enabled": {
                               "type": "boolean"
                             },
+                            "reason": {
+                              "type": [
+                                "string",
+                                "null"
+                              ]
+                            },
                             "api_url": {
                               "type": [
                                 "string",
@@ -30850,6 +30970,7 @@
                           },
                           "required": [
                             "enabled",
+                            "reason",
                             "api_url",
                             "live_url",
                             "org_id",
@@ -33807,9 +33928,11 @@
           },
           {
             "schema": {
-              "type": "string"
+              "type": "string",
+              "description": "Search task text and title by word or phrase, with a prefix match on the last word, or a task id by prefix. Not a substring match: '2443' does not find '12443', and '%' and '_' are not wildcards."
             },
             "required": false,
+            "description": "Search task text and title by word or phrase, with a prefix match on the last word, or a task id by prefix. Not a substring match: '2443' does not find '12443', and '%' and '_' are not wildcards.",
             "name": "search",
             "in": "query"
           },
@@ -54576,6 +54699,9 @@
                             "uncertain": {
                               "type": "number"
                             },
+                            "ackNotReady": {
+                              "type": "number"
+                            },
                             "lastOutcomeAt": {
                               "type": [
                                 "string",
@@ -54606,6 +54732,7 @@
                             "ignored",
                             "failed",
                             "uncertain",
+                            "ackNotReady",
                             "lastOutcomeAt",
                             "lastFailure"
                           ]
@@ -54625,6 +54752,9 @@
                             "uncertain": {
                               "type": "number"
                             },
+                            "ackNotReady": {
+                              "type": "number"
+                            },
                             "lastOutcomeAt": {
                               "type": [
                                 "string",
@@ -54655,6 +54785,7 @@
                             "ignored",
                             "failed",
                             "uncertain",
+                            "ackNotReady",
                             "lastOutcomeAt",
                             "lastFailure"
                           ]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@desplega.ai/agent-swarm",
-  "version": "2.7.2",
+  "version": "2.7.3",
   "description": "agent-swarm.dev — an open-source operating system for AI work: a lead agent breaks goals into tasks, routes them to specialized workers such as Claude Code or Codex, runs each worker in an isolated container, and preserves shared memory, tools, schedules, and review gates so delegated work compounds across sessions.",
   "keywords": [
     "agent-swarm.dev",
@@ -203,7 +203,7 @@
   "dependencies": {
     "@agentclientprotocol/sdk": "2.0.2",
     "@ai-sdk/openai": "^3.0.41",
-    "@anthropic-ai/claude-agent-sdk": "0.3.311",
+    "@anthropic-ai/claude-agent-sdk": "0.3.312",
     "@anthropic-ai/sdk": "^1.3.0",
     "@asteasolutions/zod-to-openapi": "^8.0.0",
     "@aws-sdk/client-bedrock": "3.1048.0",
@@ -211,8 +211,8 @@
     "@chat-adapter/slack": "4.41.1",
     "@chat-adapter/teams": "4.41.1",
     "@chat-adapter/telegram": "4.41.1",
-    "@cursor/sdk": "1.1.0",
-    "@desplega.ai/agent-fs-just-bash": "0.18.11",
+    "@cursor/sdk": "1.2.0",
+    "@desplega.ai/agent-fs-just-bash": "0.18.12",
     "@desplega.ai/business-use": "^0.4.2",
     "@earendil-works/pi-agent-core": "^1.4.0",
     "@earendil-works/pi-ai": "^1.4.0",
@@ -221,7 +221,7 @@
     "@jitl/quickjs-singlefile-mjs-release-sync": "0.32.0",
     "@linear/sdk": "^77.0.0",
     "@modelcontextprotocol/sdk": "1.32.1",
-    "@openai/codex": "0.164.0",
+    "@openai/codex": "0.165.0",
     "@openfort/openfort-node": "^0.9.1",
     "@opentelemetry/api": "^1.9.1",
     "@opentelemetry/api-logs": "^0.218.0",

package/src/be/db/agents.ts

@@ -5,12 +5,13 @@ import type {
   AgentLog,
   AgentLogEventType,
   AgentSkill,
+  AgentSlackIcon,
   AgentStatus,
   AgentTask,
   ProviderName,
   RoutingAffinity,
 } from "../../types";
-import { AgentAvatarSchema } from "../../types";
+import { AgentAvatarSchema, AgentSlackIconSchema } from "../../types";
 import { isEnvFlagEnabled } from "../../utils/env-flag";
 import { getDbClient } from "./runtime";
 
@@ -63,6 +64,8 @@ export type AgentRow = {
   cred_status: string | null;
   /** Migration 119: custom avatar (JSON of AgentAvatar). NULL = deterministic hash-derived fallback. */
   avatar: string | null;
+  /** Migration 256: JSON of AgentSlackIcon. */
+  slack_icon: string | null;
   runtime_pool_id: string | null;
   runtime_provision_attempts: number;
   runtime_provision_retry_at: string | null;
@@ -81,6 +84,17 @@ function parseAgentAvatar(raw: string | null): AgentAvatar | null {
   }
 }
 
+/** Malformed content falls back to `null`, like `parseAgentAvatar`. */
+function parseAgentSlackIcon(raw: string | null): AgentSlackIcon | null {
+  if (!raw) return null;
+  try {
+    const parsed = AgentSlackIconSchema.safeParse(JSON.parse(raw));
+    return parsed.success ? parsed.data : null;
+  } catch {
+    return null;
+  }
+}
+
 /**
  * Map an agent row to the `Agent` shape. When `slim` is true the six identity
  * markdown blobs (`claudeMd`/`soulMd`/`identityMd`/`toolsMd`/`heartbeatMd`/
@@ -112,6 +126,7 @@ export function rowToAgent(row: AgentRow, slim = false): Agent {
       : null,
     credStatus: row.cred_status ? (JSON.parse(row.cred_status) as AgentCredStatus) : null,
     avatar: parseAgentAvatar(row.avatar),
+    slackIcon: parseAgentSlackIcon(row.slack_icon),
   };
   if (slim) return base;
   return {

package/src/be/db/runtime.ts

@@ -201,25 +201,35 @@ function bootOpenedDb(
         .all()
         .map((column) => `"${column.name.replaceAll('"', '""')}"`)
         .join(", ");
+      // Triggers on other tables that read agent_tasks (the session summary
+      // recompute, migration 253) would fail the rename's schema check while
+      // agent_tasks is dropped, so they are dropped and re-created too.
       const schemaObjects = database
-        .prepare<{ sql: string }, []>(
-          `SELECT sql FROM sqlite_master
-           WHERE tbl_name = 'agent_tasks'
-             AND type IN ('index', 'trigger')
+        .prepare<{ name: string; tbl_name: string; sql: string }, []>(
+          `SELECT name, tbl_name, sql FROM sqlite_master
+           WHERE type IN ('index', 'trigger')
              AND sql IS NOT NULL
+             AND (tbl_name = 'agent_tasks' OR (type = 'trigger' AND sql LIKE '%agent_tasks%'))
            ORDER BY type, name`,
         )
-        .all()
-        .map((row) => row.sql);
-
-      database.transaction(() => {
-        database.run("DROP TABLE IF EXISTS agent_tasks_new");
-        database.run(rebuiltSchemaSql);
-        database.run(`INSERT INTO agent_tasks_new (${columns}) SELECT ${columns} FROM agent_tasks`);
-        database.run("DROP TABLE agent_tasks");
-        database.run("ALTER TABLE agent_tasks_new RENAME TO agent_tasks");
-        for (const sql of schemaObjects) database.run(sql);
-      })();
+        .all();
+
+      database
+        .transaction(() => {
+          database.run("DROP TABLE IF EXISTS agent_tasks_new");
+          database.run(rebuiltSchemaSql);
+          // Copy rowids too: agent_tasks_fts (migration 256) is keyed by them.
+          database.run(
+            `INSERT INTO agent_tasks_new (rowid, ${columns}) SELECT rowid, ${columns} FROM agent_tasks`,
+          );
+          for (const object of schemaObjects) {
+            if (object.tbl_name !== "agent_tasks") database.run(`DROP TRIGGER "${object.name}"`);
+          }
+          database.run("DROP TABLE agent_tasks");
+          database.run("ALTER TABLE agent_tasks_new RENAME TO agent_tasks");
+          for (const object of schemaObjects) database.run(object.sql);
+        })
+        .immediate();
 
       database.run("PRAGMA foreign_keys=on");
       console.log("[Migration] Successfully removed CHECK constraint on agent_tasks.status");

package/src/be/db/session-summaries.ts

@@ -0,0 +1,120 @@
+import { getDbClient } from "./runtime";
+
+/**
+ * `session_summaries` and `session_members` (migration 253) store the session
+ * chain walk: one row per root with its chain aggregates, and the root of
+ * every chain task. Triggers keep them exact on every task, steering and
+ * approval write. The one exception is a deleted task's descendants: a
+ * trigger body cannot walk the chain, so `deleteTask` calls
+ * {@link dropSessionDescendants} before the DELETE.
+ */
+
+/**
+ * Drop the members rows of a task's descendants. Once the task is gone, the
+ * chain walk no longer reaches them, so they belong to no session. Call it in
+ * the delete's transaction, before the DELETE; the delete trigger then
+ * recomputes the chain's summary.
+ */
+export async function dropSessionDescendants(taskId: string): Promise<void> {
+  // UNION, not UNION ALL: a parentTaskId cycle written before migration 253
+  // must not loop.
+  await getDbClient().run(
+    `WITH RECURSIVE descendant(id) AS (
+      SELECT id FROM agent_tasks WHERE parentTaskId = ?
+      UNION SELECT t.id FROM descendant d JOIN agent_tasks t ON t.parentTaskId = d.id
+    ) DELETE FROM session_members WHERE taskId IN (SELECT id FROM descendant)`,
+    [taskId],
+  );
+}
+
+export interface SessionSummaryDrift {
+  rootId: string;
+  /** The field that differs, or `member` for a chain task whose members row is wrong. */
+  field:
+    | "summary-missing"
+    | "summary-extra"
+    | "chainCount"
+    | "lastActivityAt"
+    | "latestStatus"
+    | "pendingApproval"
+    | "lastHumanAt"
+    | "member";
+  expected: string | number | null;
+  stored: string | number | null;
+}
+
+const HUMAN_TASK_SQL = `t.requestedByUserId IS NOT NULL AND t.requestedByUserIdInherited = 0
+  AND COALESCE(t.source, '') NOT IN ('mcp', 'system', 'schedule', 'workflow')`;
+
+/**
+ * Read-only drift check: compares the stored summaries and members with a
+ * fresh chain walk (the rule `sessionSummaryQuery` applies today). Returns one
+ * row per mismatch, so an empty result means the tables are exact. With
+ * `since`, only roots whose chain activity is at or after it are compared.
+ * `latestStatus` is skipped when two chain tasks tie on the newest
+ * `lastUpdatedAt`: the walk then picks an arbitrary one.
+ */
+export function sessionSummaryDriftQuery(since: string | null = null): {
+  sql: string;
+  params: (string | null)[];
+} {
+  return {
+    sql: `WITH RECURSIVE chain(root_id, id) AS (
+      SELECT id, id FROM agent_tasks WHERE parentTaskId IS NULL
+      UNION ALL SELECT c.root_id, t.id FROM chain c JOIN agent_tasks t ON t.parentTaskId = c.id
+    ), walked AS (
+      SELECT c.root_id, COUNT(*) AS chainCount, t.status AS latestStatus,
+        MAX(t.lastUpdatedAt) AS lastActivityAt
+      FROM chain c JOIN agent_tasks t ON t.id = c.id GROUP BY c.root_id
+    ), expected AS (
+      SELECT w.*,
+        (SELECT COUNT(*) FROM chain c JOIN agent_tasks t ON t.id = c.id
+          WHERE c.root_id = w.root_id AND t.lastUpdatedAt = w.lastActivityAt) AS newest,
+        EXISTS (SELECT 1 FROM chain c JOIN approval_requests ar ON ar.sourceTaskId = c.id
+          WHERE c.root_id = w.root_id AND ar.status = 'pending') AS pendingApproval,
+        (SELECT MAX(at) FROM (
+          SELECT t.createdAt AS at FROM chain c JOIN agent_tasks t ON t.id = c.id
+          WHERE c.root_id = w.root_id AND ${HUMAN_TASK_SQL}
+          UNION ALL SELECT sm.created_at FROM chain c JOIN task_steering_messages sm ON sm.task_id = c.id
+          WHERE c.root_id = w.root_id AND sm.created_by_kind = 'user' AND sm.status != 'cancelled'
+          UNION ALL SELECT ar.createdAt FROM chain c JOIN approval_requests ar ON ar.sourceTaskId = c.id
+          WHERE c.root_id = w.root_id AND ar.status = 'pending')) AS lastHumanAt
+      FROM walked w WHERE (? IS NULL OR w.lastActivityAt >= ?)
+    ), stored AS (
+      SELECT * FROM session_summaries s WHERE (? IS NULL OR s.lastActivityAt >= ?)
+    )
+    SELECT e.root_id AS rootId, 'summary-missing' AS field, e.chainCount AS expected, NULL AS stored
+      FROM expected e LEFT JOIN session_summaries s ON s.rootId = e.root_id WHERE s.rootId IS NULL
+    UNION ALL SELECT s.rootId, 'summary-extra', NULL, s.chainCount
+      FROM stored s LEFT JOIN walked w ON w.root_id = s.rootId WHERE w.root_id IS NULL
+    UNION ALL SELECT e.root_id, 'chainCount', e.chainCount, s.chainCount
+      FROM expected e JOIN session_summaries s ON s.rootId = e.root_id WHERE s.chainCount IS NOT e.chainCount
+    UNION ALL SELECT e.root_id, 'lastActivityAt', e.lastActivityAt, s.lastActivityAt
+      FROM expected e JOIN session_summaries s ON s.rootId = e.root_id
+      WHERE s.lastActivityAt IS NOT e.lastActivityAt
+    UNION ALL SELECT e.root_id, 'latestStatus', e.latestStatus, s.latestStatus
+      FROM expected e JOIN session_summaries s ON s.rootId = e.root_id
+      WHERE e.newest = 1 AND s.latestStatus IS NOT e.latestStatus
+    UNION ALL SELECT e.root_id, 'pendingApproval', e.pendingApproval, s.pendingApprovalCount > 0
+      FROM expected e JOIN session_summaries s ON s.rootId = e.root_id
+      WHERE (s.pendingApprovalCount > 0) IS NOT e.pendingApproval
+    UNION ALL SELECT e.root_id, 'lastHumanAt', e.lastHumanAt, s.lastHumanAt
+      FROM expected e JOIN session_summaries s ON s.rootId = e.root_id
+      WHERE s.lastHumanAt IS NOT e.lastHumanAt
+    UNION ALL SELECT c.root_id, 'member', c.id, m.rootId
+      FROM chain c JOIN expected e ON e.root_id = c.root_id
+      LEFT JOIN session_members m ON m.taskId = c.id WHERE m.rootId IS NOT c.root_id
+    UNION ALL SELECT m.rootId, 'member', NULL, m.taskId
+      FROM session_members m LEFT JOIN chain c ON c.id = m.taskId AND c.root_id = m.rootId
+      WHERE c.id IS NULL AND (? IS NULL OR m.rootId IN (SELECT rootId FROM stored))`,
+    params: [since, since, since, since, since],
+  };
+}
+
+/** Run {@link sessionSummaryDriftQuery}. */
+export async function findSessionSummaryDrift(
+  since: string | null = null,
+): Promise<SessionSummaryDrift[]> {
+  const query = sessionSummaryDriftQuery(since);
+  return await getDbClient().query<SessionSummaryDrift>(query.sql, query.params);
+}