@sema-agent/server 3.20.0 → 3.22.0

package/dist/plugins/host-platform.js

@@ -22,6 +22,7 @@
  * ⚠️ The win32 branches are UNVERIFIED on a real machine until S5 (Windows CI runner) — design D5 discipline:
  * structural tests only on mac/Linux; behavior-level bite happens on the first Windows-runner green.
  */
+import os from "node:os";
 import { getShellConfig, killProcessTree, signalProcessTree } from "@sema-agent/core";
 export const IS_WIN32 = process.platform === "win32";
 /** S1([1870] test AI 全归因,2026-07-27):POSIX 不再硬编码 `/bin/sh`——Debian/Ubuntu 的 /bin/sh 是
@@ -135,6 +136,19 @@ export function collapseWin32EnvKeys(env) {
         return env;
     return collapseEnvKeysCaseInsensitive(env);
 }
+/**
+ * Conventional exit-code mapping for a process killed by a signal (128 + signal number). Single pattern-home
+ * construction point for every exec adapter that must turn a `close` event's external-kill case
+ * (`code===null`, `signal` set) into an exit code instead of silently reporting a fake success 0 — the host
+ * lane, ssh, adb, and local-docker all consume THIS function; none of them may hand-write their own signal
+ * table. Uses Node's authoritative platform table (`os.constants.signals`) rather than a hand-written list —
+ * a hand-written table has previously missed `SIGABRT`/`SIGPIPE` (`kill -ABRT` reported 137, impersonating
+ * `SIGKILL`). Callers keep a `?? 9` fallback for a name the platform table doesn't define, matching core's
+ * `SIGNUM[signal] ?? 9`.
+ */
+export function signalNumber(signal) {
+    return os.constants.signals[signal];
+}
 /** The platform-free collapse algorithm (exported so the mac/Linux suite can pin the win32 behavior — design
  *  D5: structural verification everywhere, behavioral bite on the Windows runner). */
 export function collapseEnvKeysCaseInsensitive(env) {

package/dist/plugins/memory-engine-tidb.js

@@ -23,6 +23,7 @@
 //     (`${name ?? slug} ${description} ${body}`——memoryBackendContract 的 search 等价断言依赖)。
 import { jaccardDistance, termSet } from "./memory-engine-vector-util.js";
 import { computeEntryRev, serializeEntryFile } from "@sema-agent/core";
+import { pgHasUnstorable } from "./pg-safe-json.js";
 /** Table names (single source) — SAME names as PG_MEMORY_ENGINE_TABLES (the two dialects never share
  *  one database), deliberately DISJOINT from the legacy `agent_memory*` MemoryStore plane. */
 export const TIDB_MEMORY_ENGINE_TABLES = {
@@ -224,6 +225,15 @@ export class TiDBMemoryEngineBackend {
                 report.conflicts.push({ op: "add", id: patch.id, reason: "add patch without an entry" });
                 return;
             }
+            // Reject-not-rewrite for bytes SQL cannot store(Pg 版 applyOne add 分支同一守卫,复用同一
+            // pgHasUnstorable——不是重派生一份近似正则):NUL / 孤立 UTF-16 代理不是 PG 独有的病,mysql2/
+            // utf8mb4 对同样的字节没有 PG 的 22P05 fail-loud 报错,驱动或服务端会静默 mangle(丢字节/替换为
+            // U+FFFD 视驱动版本而定),写入侧不炸、读回侧才发现内容偏离——这比 PG 的写时报错更隐蔽。三后端
+            // (pg/tidb/local)必须对同一输入给出同一行为,否则同一份 sync 数据在不同部署形态下悄悄分叉。
+            if (pgHasUnstorable(entry.frontmatter) || pgHasUnstorable(entry.body) || pgHasUnstorable(entry.slug)) {
+                report.conflicts.push({ op: "add", id: entry.id, reason: "unstorable_bytes (utf8mb4 cannot store NUL/lone surrogates without mangling; strip them at the source — the store never rewrites content)" });
+                return;
+            }
             // Cross-scope add refusal (opus 审 C3,Pg 版同注): an add whose id already lives in a DIFFERENT
             // scope must not silently MOVE the row; same-scope re-add stays the idempotent overwrite.
             // One probe serves BOTH the E-02 guard and the cross-scope refusal (File/Pg parity).
@@ -369,6 +379,12 @@ export class TiDBMemoryEngineBackend {
             report.conflicts.push({ op: "update", id: patch.id, reason: "update patch without an entry" });
             return;
         }
+        // Same reject-not-rewrite guard as the add leg above(Pg 版 applyOne update 分支同一守卫)—
+        // an update carrying unstorable bytes must refuse before the CAS write, not mangle silently.
+        if (pgHasUnstorable(entry.frontmatter) || pgHasUnstorable(entry.body) || pgHasUnstorable(entry.slug)) {
+            report.conflicts.push({ op: "update", id: patch.id, reason: "unstorable_bytes (utf8mb4 cannot store NUL/lone surrogates without mangling; strip them at the source — the store never rewrites content)" });
+            return;
+        }
         const rev = computeEntryRev(entry);
         const res = await this.write(`UPDATE ${T} SET scope = ?, slug = ?, frontmatter = ?, body = ?, rev = ?, mtime_ms = ?, size_bytes = ?, embedding = NULL WHERE id = ? AND rev = ?`, [entry.scope, entry.slug, JSON.stringify(entry.frontmatter), entry.body, rev, this.clock(), Buffer.byteLength(serializeEntryFile(entry), "utf8"), entry.id, currentRev]);
         if (res.affectedRows === 0) {

package/dist/plugins/memory-run-store.js

@@ -127,8 +127,15 @@ export class MemoryRunStore {
      *  [1.207 codex M1] 负向形漏 blocked/timeout);claim 释放保持无条件(幂等)。 */
     async setTerminal(taskId, status, result, error) {
         const r = this.runs.get(taskId);
-        if (!r)
+        if (!r) {
+            // [2255]③ file 孪生同判据(parity oracle):行缺席时终局动词仍放锁(反查 active)。
+            for (const [sessionId, tid] of this.active)
+                if (tid === taskId) {
+                    this.active.delete(sessionId);
+                    break;
+                }
             return;
+        }
         if (r.status === "running" || r.status === "suspended" || r.status === "needs_review") {
             r.status = status;
             r.result = result;
@@ -184,9 +191,9 @@ export class MemoryRunStore {
         const cursorAt = opts.cursor ? Date.parse(opts.cursor.createdAt) : undefined;
         const rows = [...this.runs.values()]
             .filter((r) => (opts.status ? r.status === opts.status : true))
-            .filter((r) => (opts.jobId ? r.jobId === opts.jobId : true))
-            .filter((r) => (opts.source ? r.source === opts.source : true))
-            .filter((r) => (opts.owner ? r.owner === opts.owner : true)) // exact (SQL `owner = ?`): a set owner excludes null-owner rows
+            .filter((r) => (opts.jobId !== undefined ? r.jobId === opts.jobId : true)) // "" is a valid exact jobId, not "no filter" (B10)
+            .filter((r) => (opts.source !== undefined ? r.source === opts.source : true)) // "" is a valid exact source, not "no filter" (B10)
+            .filter((r) => (opts.owner !== undefined ? r.owner === opts.owner : true)) // exact (SQL `owner = ?`): "" is a valid exact owner, not "no filter" (B10)
             .filter((r) => {
             if (cursorAt === undefined)
                 return true;
@@ -200,8 +207,8 @@ export class MemoryRunStore {
     async listSessions(opts) {
         const bySession = new Map();
         for (const r of this.runs.values()) {
-            if (opts.owner && r.owner !== opts.owner)
-                continue; // exact owner filter (SQL `owner = ?`)
+            if (opts.owner !== undefined && r.owner !== opts.owner)
+                continue; // exact owner filter (SQL `owner = ?`); "" is a valid exact owner (B10)
             const arr = bySession.get(r.sessionId) ?? [];
             arr.push(r);
             bySession.set(r.sessionId, arr);
@@ -328,8 +335,10 @@ export class MemoryRunStore {
      */
     async reapSuspended(olderThanMs) {
         const probe = this.checkpointProbe;
-        if (!probe)
+        if (!probe) {
+            this.releaseTerminalClaims();
             return 0;
+        } // [2255]③ claim 不变式维护不跟 probe 走
         const cutoff = Date.now() - olderThanMs;
         let reaped = 0;
         for (const r of this.runs.values()) {
@@ -358,8 +367,10 @@ export class MemoryRunStore {
      */
     async failSuspendedWithExpiredCheckpoint() {
         const probe = this.checkpointProbe;
-        if (!probe)
+        if (!probe) {
+            this.releaseTerminalClaims();
             return 0;
+        } // [2255]③ claim 不变式维护不跟 probe 走
         let reaped = 0;
         for (const r of this.runs.values()) {
             if (r.status !== "suspended" && r.status !== "needs_review")

package/dist/plugins/remote-env-adb.js

@@ -29,6 +29,7 @@ import os from "node:os";
 import fs from "node:fs/promises";
 import { spawn } from "node:child_process";
 import { shellQuote, armPipeDestroyGrace } from "./remote-shell.js";
+import { signalNumber } from "./host-platform.js";
 import { FileError, ExecutionError, RemoteExecutionError, withRetry, RollingTailBuffer, markTruncated, } from "@sema-agent/core";
 import { fileErrorFromExec } from "./remote-env-file-error.js";
 import { createPosixShellFs } from "./posix-shell-fs.js";
@@ -234,13 +235,15 @@ export class RemoteAdbExecutionEnv {
             finished = true;
             signalReady();
         });
-        child.on("close", (code) => {
+        child.on("close", (code, signal) => {
             if ((code ?? 0) !== 0 && isAdbTransportLost(stderrTail) && !failure) {
                 // device transport died mid-stream — typed retryable, not a fake exit ([R78]#1)
                 this.connected = false;
                 failure = new RemoteExecutionError("transport_lost", `adb transport lost mid-stream: ${stderrTail.trim().slice(0, 200)}`);
             }
-            exitCode = code ?? 0;
+            // code==null WITH a signal = the adb child was killed by an external signal (SIGKILL/OOM) — conventional
+            // 128+signo, NOT a fake success 0 ([R78]#2; the second `close` argument was dropped before this fix).
+            exitCode = code ?? (signal ? 128 + (signalNumber(signal) ?? 9) : 0);
             finished = true;
             signalReady();
         });
@@ -483,19 +486,23 @@ export class RemoteAdbExecutionEnv {
                 opts?.onStderr?.(d.toString());
             });
             child.on("error", (e) => finish({ ok: false, error: new ExecutionError("spawn_error", `adb spawn failed (is '${this.cfg.adbPath}' installed?): ${e.message}`, e) }));
-            child.on("close", (code) => {
+            child.on("close", (code, signal) => {
                 if (forceSettleTimer)
                     clearTimeout(forceSettleTimer); // `close` fired → pipes closed naturally; clear D5 grace
                 const err = errBuf.result();
                 const stderr = markTruncated(err.text, err.droppedBytes);
+                // code==null WITH a signal = the adb child was killed by an external signal (SIGKILL/OOM) —
+                // conventional 128+signo, NOT a fake success 0 ([R78]#2; the second `close` argument was dropped
+                // before this fix).
+                const exitCode = code ?? (signal ? 128 + (signalNumber(signal) ?? 9) : 0);
                 if (binary) {
                     // byte-exact: readBinaryFile decodes stdoutBytes; never truncate.
                     const stdoutBytes = Buffer.concat(outBufs);
-                    finish(ok({ stdout: stdoutBytes.toString("utf8"), stderr, exitCode: code ?? 0, stdoutBytes: new Uint8Array(stdoutBytes) }));
+                    finish(ok({ stdout: stdoutBytes.toString("utf8"), stderr, exitCode, stdoutBytes: new Uint8Array(stdoutBytes) }));
                 }
                 else {
                     const out = outTail.result();
-                    finish(ok({ stdout: markTruncated(out.text, out.droppedBytes), stderr, exitCode: code ?? 0 }));
+                    finish(ok({ stdout: markTruncated(out.text, out.droppedBytes), stderr, exitCode }));
                 }
             });
         });

package/dist/plugins/remote-env-local-docker.js

@@ -42,6 +42,7 @@ import fs from "node:fs/promises";
 import { spawn } from "node:child_process";
 import { randomBytes } from "node:crypto";
 import { shellQuote, armPipeDestroyGrace } from "./remote-shell.js";
+import { signalNumber } from "./host-platform.js";
 import { FileError, ExecutionError, RemoteExecutionError, RollingTailBuffer, markTruncated, } from "@sema-agent/core";
 import { fileErrorFromExec, classifyFsStderr } from "./remote-env-file-error.js";
 import { createPosixShellFs } from "./posix-shell-fs.js";
@@ -290,7 +291,7 @@ export class RemoteLocalDockerExecutionEnv {
         child.on("close", (code, signal) => {
             if (finished)
                 return;
-            exitCode = code ?? (signal ? 128 + (signalNumber(signal) ?? 0) : 1);
+            exitCode = code ?? (signal ? 128 + (signalNumber(signal) ?? 9) : 1);
             finished = true;
             signalReady();
         });
@@ -586,7 +587,7 @@ export class RemoteLocalDockerExecutionEnv {
                     clearTimeout(forceSettleTimer); // `close` fired → pipes closed naturally; clear D5 grace
                 // A signal-killed process (external SIGKILL/OOM) has code===null → derive the conventional 128+signo
                 // (parity with execStream + the host adapter); NEVER report a killed command as a success exitCode 0.
-                const exitCode = code ?? (signal ? 128 + (signalNumber(signal) ?? 0) : 1);
+                const exitCode = code ?? (signal ? 128 + (signalNumber(signal) ?? 9) : 1);
                 const err = errBuf.result();
                 const stderr = markTruncated(err.text, err.droppedBytes);
                 if (binary) {
@@ -664,11 +665,6 @@ function sanitizeId(id) {
 function errMsg(e) {
     return e instanceof Error ? e.message : String(e);
 }
-/** Conventional exit code for a process killed by a signal (128 + signal number); falls back to undefined. */
-function signalNumber(signal) {
-    const table = { SIGHUP: 1, SIGINT: 2, SIGQUIT: 3, SIGKILL: 9, SIGTERM: 15, SIGSEGV: 11 };
-    return table[signal];
-}
 /**
  * `ExecutionEnvFactory` for the TOC `local-docker` backend (DUAL-MODE-DESIGN §5). Wiring this onto a deployment
  * makes its agent run each task in a per-task container on the worker's OWN docker daemon (isolation:true,

package/dist/plugins/remote-env-ssh.js

@@ -22,6 +22,7 @@
 import path from "node:path";
 import { Client } from "ssh2";
 import { shellQuote, kindFromMode } from "./remote-shell.js";
+import { signalNumber } from "./host-platform.js";
 import { createPosixShellFs } from "./posix-shell-fs.js";
 import { FileError, ExecutionError, RemoteExecutionError, withRetry, RollingTailBuffer, markTruncated, } from "@sema-agent/core";
 import { fileErrorFromExec } from "./remote-env-file-error.js";
@@ -31,6 +32,13 @@ const unsupported = (op) => ({
     ok: false,
     error: new RemoteExecutionError("unsupported", `${op} is not supported on an SSH target (real machine — not snapshotable; capabilities.suspendable=false)`),
 });
+/** ssh2's ClientChannel "close" event gives the killing signal's BARE POSIX name (e.g. "KILL"), unlike Node's
+ *  own `child.on("close")` which gives `NodeJS.Signals` names (e.g. "SIGKILL") — re-prefix before looking it
+ *  up in the shared, authoritative signal table (host-platform.ts `signalNumber`; single pattern-home, no
+ *  hand-written table here). `?? 9` matches the convention every other exec adapter uses for an unmapped name. */
+function exitCodeForSignalKill(signal) {
+    return 128 + (signalNumber(`SIG${signal}`) ?? 9);
+}
 export class RemoteSshExecutionEnv {
     capabilities = { isolation: false, suspendable: false };
     /** Working directory; relative paths resolve against it (ExecutionEnv contract). Starts at mountPath. */
@@ -341,7 +349,12 @@ export class RemoteSshExecutionEnv {
                     }
                     const out = outBuf.result();
                     const err = errBuf.result();
-                    finish(ok({ stdout: markTruncated(out.text, out.droppedBytes), stderr: markTruncated(err.text, err.droppedBytes), exitCode: code ?? 0 }));
+                    // code==null WITH a signal = the remote command was killed by that signal — conventional 128+signo,
+                    // NOT a fake success 0 ([R78]#2; was silently mapped to exitCode 0 before this fix). The `: 1`
+                    // arm is unreachable (the transport_lost return above already covers code==null && !signal) but
+                    // keeps the type honest without a non-null assertion.
+                    const exitCode = code ?? (signal ? exitCodeForSignalKill(signal) : 1);
+                    finish(ok({ stdout: markTruncated(out.text, out.droppedBytes), stderr: markTruncated(err.text, err.droppedBytes), exitCode }));
                 })
                     .stderr.on("data", (d) => {
                     errBuf.push(d);
@@ -445,7 +458,9 @@ export class RemoteSshExecutionEnv {
                     // channel died without an exit status (transport drop) — typed retryable, not a fake exit 0 ([R78]#1)
                     failure = new RemoteExecutionError("transport_lost", "ssh channel closed without exit status (transport lost)");
                 }
-                exitCode = code ?? 0;
+                // code==null WITH a signal = the remote command was killed by that signal — conventional 128+signo,
+                // NOT a fake success 0 ([R78]#2; was silently mapped to exitCode 0 before this fix).
+                exitCode = code ?? (signal ? exitCodeForSignalKill(signal) : 0);
                 finished = true;
                 signalReady();
             })

package/dist/plugins/run-store-sql.js

@@ -289,16 +289,16 @@ export class SqlRunStore {
                 where.push("status = ?");
                 params.push(opts.status);
             }
-            if (opts.jobId) {
+            if (opts.jobId !== undefined) {
                 where.push("job_id = ?");
                 params.push(opts.jobId);
             }
-            if (opts.source) {
+            if (opts.source !== undefined) {
                 where.push("source = ?");
                 params.push(opts.source);
             }
-            if (opts.owner) {
-                where.push("owner = ?"); // idx_owner — the per-user list view (portal scopes a normal user to their own)
+            if (opts.owner !== undefined) {
+                where.push("owner = ?"); // idx_owner — the per-user list view (portal scopes a normal user to their own); "" is a valid exact owner, not "no filter" (B10)
                 params.push(opts.owner);
             }
             if (opts.cursor) {
@@ -320,12 +320,12 @@ export class SqlRunStore {
         const where = [];
         if (opts.status)
             where.push(`status = ${p(opts.status)}`);
-        if (opts.jobId)
+        if (opts.jobId !== undefined)
             where.push(`job_id = ${p(opts.jobId)}`);
-        if (opts.source)
-            where.push(`source = ${p(opts.source)}`);
-        if (opts.owner)
-            where.push(`owner = ${p(opts.owner)}`);
+        if (opts.source !== undefined)
+            where.push(`source = ${p(opts.source)}`); // "" exact-matches (B10, same family as owner)
+        if (opts.owner !== undefined)
+            where.push(`owner = ${p(opts.owner)}`); // "" is a valid exact owner, not "no filter" (B10)
         if (opts.cursor) {
             const a = p(new Date(opts.cursor.createdAt));
             const b = p(new Date(opts.cursor.createdAt));
@@ -348,8 +348,8 @@ export class SqlRunStore {
         if (this.db.dialect === "tidb") {
             const params = [];
             let innerWhere = "";
-            if (opts.owner) {
-                innerWhere = " WHERE owner = ?";
+            if (opts.owner !== undefined) {
+                innerWhere = " WHERE owner = ?"; // "" is a valid exact owner, not "no filter" (B10)
                 params.push(opts.owner);
             }
             const outer = ["rn = 1"];
@@ -381,7 +381,7 @@ export class SqlRunStore {
             params.push(v);
             return `$${params.length}`;
         };
-        const innerWhere = opts.owner ? ` WHERE owner = ${p(opts.owner)}` : "";
+        const innerWhere = opts.owner !== undefined ? ` WHERE owner = ${p(opts.owner)}` : ""; // "" is a valid exact owner, not "no filter" (B10)
         const outer = ["rn = 1"];
         // `?q=` — the PG twin of the TiDB EXISTS predicate above.
         if (opts.q)
@@ -520,6 +520,12 @@ export class SqlRunStore {
             // claim — the session stays locked until an operator resumes it or reapSuspended expires it. (Was
             // `<> 'running'`, which would have prematurely unlocked a parked suspended session.)
             await conn.query(this.q("DELETE ta FROM task_active ta JOIN task_run tr ON ta.task_id = tr.task_id WHERE tr.status NOT IN ('running','suspended','needs_review')", "DELETE FROM task_active ta USING task_run tr WHERE ta.task_id = tr.task_id AND tr.status NOT IN ('running','suspended','needs_review')"));
+            // [2255]③ 孤儿 claim 清扫(纵深防御):claim 无对应 task_run 行时,三处 INNER JOIN 释放腿永远碰不到
+            // 它。正常路径不产孤儿(createRun 单事务、setTerminal 无条件 DELETE、deleteBySession 同事务对称)——
+            // 这形只来自带外(手工 SQL/半截迁移),但一旦出现该 session 只剩 cancel 一条自救路。挂在 reapStale
+            // (每 tick 无条件跑)一处即可。同文双方言(关联 NOT EXISTS 指向**另一张**表,两引擎都合法);
+            // 无竞态:createRun 的 claim+row 同事务提交,已提交的 claim 必有行。
+            await conn.query(this.q("DELETE FROM task_active WHERE NOT EXISTS (SELECT 1 FROM task_run tr WHERE tr.task_id = task_active.task_id)", "DELETE FROM task_active WHERE NOT EXISTS (SELECT 1 FROM task_run tr WHERE tr.task_id = task_active.task_id)"));
         });
         return reaped;
     }

package/dist/plugins/store-backend.d.ts

@@ -144,7 +144,7 @@ export interface StoreBackend {
     /** P1 (fleet failover): durable cross-replica WorkflowRunStore + completion-inbox twins. OPTIONAL —
      *  SQL backends only (local keeps the File pair: single box, no cross-replica surface). main.ts prefers
      *  these under WORKFLOW_RUN_STORE=auto (the default). */
-    workflowRun?(): import("@sema-agent/core").WorkflowRunStore;
+    workflowRun?(onWarn?: InboxWarn): import("@sema-agent/core").WorkflowRunStore;
     completionInbox?(onWarn?: InboxWarn): import("../orchestration/workflow-completion-inbox.js").WorkflowCompletionInbox;
     /** 1.108 review fix (lens③ HIGH): the notify-JOURNAL twin — third leg of the same axis (a SQL run store +
      *  inbox with a replica-LOCAL File journal stranded a dead replica's un-acked notify forever). */

package/dist/plugins/store-backend.js

@@ -113,7 +113,7 @@ class TiDBBackend {
     fileSnapshot() { return new TiDBFileSnapshotStore(this.pool, snapshotBlobBackend(this.config, "tidb", this.pool), snapshotBoundsFromConfig(this.config)); }
     workflowJournal() { return new TiDBWorkflowJournalStore(this.pool); }
     outcomeSink() { return new TiDBOutcomeLedger(this.pool); } // design/73 §1→§7 bridge (recordCore)
-    workflowRun() { return new TiDBWorkflowRunStore(this.pool); } // P1: cross-replica workflow record
+    workflowRun(onWarn) { return new TiDBWorkflowRunStore(this.pool, onWarn); } // P1: cross-replica workflow record(onWarn = C5 oversize-slim 留痕,completionInbox 同款先例)
     completionInbox(onWarn) { return new TiDBWorkflowCompletionInbox(this.pool, onWarn); } // P1: cross-replica push half
     notifyJournal() { return new TiDBWorkflowNotifyJournalStore(this.pool); } // 1.108: cross-replica at-least-once notify
     checkpoint(logger) { return new TiDBCheckpointStore(this.pool, logger); }
@@ -147,7 +147,7 @@ class PgBackend {
     fileSnapshot() { return new PgFileSnapshotStore(this.pool, snapshotBlobBackend(this.config, "pg", this.pool), snapshotBoundsFromConfig(this.config)); }
     workflowJournal() { return new PgWorkflowJournalStore(this.pool); }
     outcomeSink() { return new PgOutcomeLedger(this.pool); } // design/73 §1→§7 bridge (recordCore)
-    workflowRun() { return new PgWorkflowRunStore(this.pool); } // P1: cross-replica workflow record
+    workflowRun(onWarn) { return new PgWorkflowRunStore(this.pool, onWarn); } // P1: cross-replica workflow record(onWarn = C5 oversize-slim 留痕,completionInbox 同款先例)
     completionInbox(onWarn) { return new PgWorkflowCompletionInbox(this.pool, onWarn); } // P1: cross-replica push half
     notifyJournal() { return new PgWorkflowNotifyJournalStore(this.pool); } // 1.108: cross-replica at-least-once notify
     checkpoint(logger) { return new PgCheckpointStore(this.pool, logger); }

package/dist/plugins/tool-result-store-sql.d.ts

@@ -29,7 +29,13 @@ export declare class SqlToolResultStore implements ToolResultStore {
         offset?: number;
         limit?: number;
     }): Promise<ToolResultSlice | undefined>;
-    /** TTL reap: delete results older than `cutoffMs`. Returns rows removed. */
+    /** TTL reap: delete results older than `cutoffMs`. Returns rows removed.
+     *  C6: a real DB error must NOT collapse into the same `0` a legitimate "nothing was old enough" returns —
+     *  those are different facts (query failed vs. query succeeded on an empty set) and folding them together
+     *  makes a stuck/broken reaper indistinguishable from a healthy quiet one. Matches every sibling reaper's
+     *  form (roster-store-sql.ts `reapOlderThan`, checkpoint-store-sql.ts `reapExpired`,
+     *  workflow-journal-store-sql.ts `reapExpired`): let the error propagate — the periodic-sweep call site
+     *  (boot/reapers.ts) already wraps this call in `.catch(() => undefined)` so the reap loop itself never dies. */
     reapOlderThan(cutoffMs: number): Promise<number>;
     /**
      * E21 (§0.5 session delete) — purge offloaded tool results for one session. core namespaces every ref as

package/dist/plugins/tool-result-store-sql.js

@@ -123,15 +123,16 @@ export class SqlToolResultStore {
             return undefined; // unknown ref (e.g. reaped) → core reports "no longer available"
         return { content: String(rows[0].slice ?? ""), offset, totalChars: Number(rows[0].total) };
     }
-    /** TTL reap: delete results older than `cutoffMs`. Returns rows removed. */
+    /** TTL reap: delete results older than `cutoffMs`. Returns rows removed.
+     *  C6: a real DB error must NOT collapse into the same `0` a legitimate "nothing was old enough" returns —
+     *  those are different facts (query failed vs. query succeeded on an empty set) and folding them together
+     *  makes a stuck/broken reaper indistinguishable from a healthy quiet one. Matches every sibling reaper's
+     *  form (roster-store-sql.ts `reapOlderThan`, checkpoint-store-sql.ts `reapExpired`,
+     *  workflow-journal-store-sql.ts `reapExpired`): let the error propagate — the periodic-sweep call site
+     *  (boot/reapers.ts) already wraps this call in `.catch(() => undefined)` so the reap loop itself never dies. */
     async reapOlderThan(cutoffMs) {
-        try {
-            const { affected } = await this.db.query(this.q("DELETE FROM tool_result WHERE created_at < ?", "DELETE FROM tool_result WHERE created_at < $1"), [new Date(cutoffMs)]);
-            return affected;
-        }
-        catch {
-            return 0; // best-effort reaper — never throw into the loop
-        }
+        const { affected } = await this.db.query(this.q("DELETE FROM tool_result WHERE created_at < ?", "DELETE FROM tool_result WHERE created_at < $1"), [new Date(cutoffMs)]);
+        return affected;
     }
     /**
      * E21 (§0.5 session delete) — purge offloaded tool results for one session. core namespaces every ref as

package/dist/plugins/workflow-run-store-sql.d.ts

@@ -79,10 +79,13 @@ export declare function slimOversizeRun(run: WorkflowRun & {
     id: string;
     scope: string;
 }, maxBytes: number): string | null;
-/** Dual-dialect durable `WorkflowRunStore`. See the file header for the dialect-delta ledger. */
+/** Dual-dialect durable `WorkflowRunStore`. See the file header for the dialect-delta ledger.
+ *  `onWarn` (optional, same shape as the completion-inbox's {@link InboxWarn}) is the C5 trace channel for
+ *  `update`'s oversize-slim degrade (see there) — omit it and construction/behavior is unchanged (additive). */
 export declare class SqlWorkflowRunStore implements WorkflowRunStore {
     protected readonly db: SqlDriver;
-    constructor(db: SqlDriver);
+    private readonly onWarn?;
+    constructor(db: SqlDriver, onWarn?: InboxWarn | undefined);
     /** Pick the dialect's SQL text. Both statements stay written out at the call site ON PURPOSE. */
     private q;
     put(id: string, run: WorkflowRun): Promise<void>;
@@ -145,9 +148,10 @@ export declare class SqlWorkflowNotifyJournalStore implements WorkflowNotifyJour
     reapAcked(before: number): Promise<number>;
     get(runId: string): Promise<WorkflowNotifyJournalEntry | null>;
 }
-/** MySQL-protocol (TiDB) bindings — historical class names + ctor shapes preserved. */
+/** MySQL-protocol (TiDB) bindings — historical class names preserved; `onWarn` is an ADDITIVE optional 2nd
+ *  ctor arg (existing 1-arg call sites are unaffected — see {@link SqlWorkflowRunStore}'s C5 trace channel). */
 export declare class TiDBWorkflowRunStore extends SqlWorkflowRunStore {
-    constructor(pool: MySqlPool);
+    constructor(pool: MySqlPool, onWarn?: InboxWarn);
 }
 export declare class TiDBWorkflowCompletionInbox extends SqlWorkflowCompletionInbox {
     constructor(pool: MySqlPool, onWarn?: InboxWarn);
@@ -155,9 +159,10 @@ export declare class TiDBWorkflowCompletionInbox extends SqlWorkflowCompletionIn
 export declare class TiDBWorkflowNotifyJournalStore extends SqlWorkflowNotifyJournalStore {
     constructor(pool: MySqlPool);
 }
-/** PostgreSQL bindings — historical class names + ctor shapes preserved. */
+/** PostgreSQL bindings — historical class names preserved; `onWarn` is an ADDITIVE optional 2nd ctor arg
+ *  (existing 1-arg call sites are unaffected — see {@link SqlWorkflowRunStore}'s C5 trace channel). */
 export declare class PgWorkflowRunStore extends SqlWorkflowRunStore {
-    constructor(pool: PgPool);
+    constructor(pool: PgPool, onWarn?: InboxWarn);
 }
 export declare class PgWorkflowCompletionInbox extends SqlWorkflowCompletionInbox {
     constructor(pool: PgPool, onWarn?: InboxWarn);

package/dist/plugins/workflow-run-store-sql.js

@@ -29,11 +29,15 @@ export function slimOversizeRun(run, maxBytes) {
     blob = JSON.stringify(step2);
     return Buffer.byteLength(blob) <= maxBytes ? blob : null;
 }
-/** Dual-dialect durable `WorkflowRunStore`. See the file header for the dialect-delta ledger. */
+/** Dual-dialect durable `WorkflowRunStore`. See the file header for the dialect-delta ledger.
+ *  `onWarn` (optional, same shape as the completion-inbox's {@link InboxWarn}) is the C5 trace channel for
+ *  `update`'s oversize-slim degrade (see there) — omit it and construction/behavior is unchanged (additive). */
 export class SqlWorkflowRunStore {
     db;
-    constructor(db) {
+    onWarn;
+    constructor(db, onWarn) {
         this.db = db;
+        this.onWarn = onWarn;
     }
     /** Pick the dialect's SQL text. Both statements stay written out at the call site ON PURPOSE. */
     q(tidb, pg) {
@@ -70,6 +74,10 @@ export class SqlWorkflowRunStore {
         if (Buffer.byteLength(blob) > MAX_RUN_BLOB_BYTES) {
             // Oversize degrade (1.108 review fix): slim the payload so the write — critically the TERMINAL one —
             // still lands (a `false` here would never be retried with a smaller payload; see slimOversizeRun).
+            // C5 (2026-07-31): the degrade drops real data (phases/agents/groups → []) — that must leave a trace
+            // reaching whoever can act on it, not just a same-shaped `true` return. `onWarn` is optional so a
+            // caller that hasn't wired a sink yet keeps building/running unchanged.
+            this.onWarn?.("workflow_run_blob_oversize_slimmed", { id, scope, fullBytes: Buffer.byteLength(blob), capBytes: MAX_RUN_BLOB_BYTES });
             const slim = slimOversizeRun({ ...run, id, scope }, MAX_RUN_BLOB_BYTES);
             if (slim === null)
                 return false; // even the skeleton is oversize — keep the prior revision
@@ -342,10 +350,11 @@ export class SqlWorkflowNotifyJournalStore {
         };
     }
 }
-/** MySQL-protocol (TiDB) bindings — historical class names + ctor shapes preserved. */
+/** MySQL-protocol (TiDB) bindings — historical class names preserved; `onWarn` is an ADDITIVE optional 2nd
+ *  ctor arg (existing 1-arg call sites are unaffected — see {@link SqlWorkflowRunStore}'s C5 trace channel). */
 export class TiDBWorkflowRunStore extends SqlWorkflowRunStore {
-    constructor(pool) {
-        super(mysqlDriver(pool));
+    constructor(pool, onWarn) {
+        super(mysqlDriver(pool), onWarn);
     }
 }
 export class TiDBWorkflowCompletionInbox extends SqlWorkflowCompletionInbox {
@@ -358,10 +367,11 @@ export class TiDBWorkflowNotifyJournalStore extends SqlWorkflowNotifyJournalStor
         super(mysqlDriver(pool));
     }
 }
-/** PostgreSQL bindings — historical class names + ctor shapes preserved. */
+/** PostgreSQL bindings — historical class names preserved; `onWarn` is an ADDITIVE optional 2nd ctor arg
+ *  (existing 1-arg call sites are unaffected — see {@link SqlWorkflowRunStore}'s C5 trace channel). */
 export class PgWorkflowRunStore extends SqlWorkflowRunStore {
-    constructor(pool) {
-        super(pgDriver(pool));
+    constructor(pool, onWarn) {
+        super(pgDriver(pool), onWarn);
     }
 }
 export class PgWorkflowCompletionInbox extends SqlWorkflowCompletionInbox {

package/dist/session-sync.js

@@ -310,9 +310,12 @@ export async function importSession(bundle, getBlob, dstBackend, importingPrinci
     //    entirely (the snapshot/policy/anchor replay below is idempotent and still runs to heal anything missing). A
     //    destination without the replace seam can't accept a session at all → throw.
     // 🔴 同上(`session-sync-content.ts` 顶注):`identical` 只说明 id 集合相等,不说明内容相同。这条路上
-    // `bundle.entries` 与目的端日志都在手上 ⇒ 直接比内容摘要;不符就照常改写(不抛错、不 409)。
-    const dstEntriesForContent = await ownerAware(dstBackend).exportEntries?.(sessionId).catch(() => null) ?? null;
-    const contentEqual = rel.relation === "identical" && identicalIdsAlsoIdenticalContent(bundle.entries, dstEntriesForContent);
+    // `bundle.entries` 与目的端日志都在手上 ⇒ 直接比内容摘要;不符就照常改写(不抛错、不 409)。复用 §7 已经
+    // 读到的 `dstEntries`(同一个 dstBackend/sessionId)——这两次读之间 dst 未被任何写触碰(overwrite-dst 擦除
+    // 只在 relation 为 fork/stale 时才跑,identical 分支不可能落进那条腿),不必也不该对同一行重新 exportEntries
+    // 一次(旧实现还用 `.catch(() => null)` 把这次读的故障裸吞成"目的端为空",见下方 identicalIdsAlsoIdenticalContent
+    // 对 null 的处置——一次真实的店读故障会被悄悄当成"内容不等"而不是 fail-loud)。
+    const contentEqual = rel.relation === "identical" && identicalIdsAlsoIdenticalContent(bundle.entries, dstEntries);
     if (rel.relation !== "identical" || !contentEqual) {
         const session = ownerAware(dstBackend);
         const replaceEntries = session.replaceEntries?.bind(session);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "3.20.0",
+  "version": "3.22.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -68,7 +68,7 @@
     "sharp": "^0.35.3"
   },
   "devDependencies": {
-    "@sema-agent/sdk": "^2.2.0",
+    "@sema-agent/sdk": "^2.3.0",
     "@types/libsodium-wrappers": "^0.7.14",
     "@types/node": "22.10.2",
     "@types/pg": "^8.20.0",