@sema-agent/server 3.21.0 → 3.22.0

package/dist/leader/wire.js

@@ -98,6 +98,18 @@ export async function stageWorkerEnv(env, opts) {
         throw new Error(`upload-script staging failed: ${wr.error.message}`);
 }
 /** Build the `runLeader(body)` the HTTP endpoint invokes. Constructs real per-task deps + runs the leader. */
+// 🔴 review-batch(重构池②,2026-08-01):`parseNumOrFail` alone still lets a NEGATIVE value through — a negative
+// number is JS-truthy, so every `parseNumOrFail(...) || default` chain in this file passed it straight through
+// instead of falling back (LEADER_WORKER_MAX_TURNS=-5 ⇒ workerMaxTurns=-5, unchanged by any later `|| default`).
+// This is the one extra domain bound (A2: illegal input INCLUDING negatives must fail loud) layered on the same
+// shared parse primitive — not a second parser. `undefined` (unset) stays NaN (`NaN < 0` is false) so the
+// existing `|| default` fallback chains are untouched; only "non-numeric" and "negative" newly throw.
+function parseNumOrFailNonNegative(name, raw) {
+    const n = parseNumOrFail(name, raw);
+    if (n < 0)
+        throw new Error(`env ${name}=${n} must not be negative`);
+    return n;
+}
 /**
  * Per-leader-run resource bounds derived from env (2026-06-14). Exported for unit tests. The worker sandbox
  * lifetime (BUG2), the worker's diff-upload presigned-URL TTL (BUG1), and the worker spec's triple bound
@@ -111,13 +123,13 @@ export async function stageWorkerEnv(env, opts) {
 // ⇒ diff 上传预签名 URL 的暴露窗口一起放大。改走与 numEnv 同源的 parseNumOrFail:非法值当场报错。
 // 刻意**零行为变更**:`|| default` 保留,所以未设与显式 0 的既有语义一个没动。
 export function leaderResourceConfig(env = process.env) {
-    const leaderTimeoutMs = Math.max(600_000, Math.floor(parseNumOrFail("LEADER_TIMEOUT_MS", env.LEADER_TIMEOUT_MS) || 0) || 86_400_000); // default 24h (was 10min)
-    const workerMaxTurns = Math.floor(parseNumOrFail("LEADER_WORKER_MAX_TURNS", env.LEADER_WORKER_MAX_TURNS) || 0) || 10_000;
-    const workerBudgetUsd = (parseNumOrFail("LEADER_WORKER_BUDGET_USD", env.LEADER_WORKER_BUDGET_USD) || 0) || 100;
+    const leaderTimeoutMs = Math.max(600_000, Math.floor(parseNumOrFailNonNegative("LEADER_TIMEOUT_MS", env.LEADER_TIMEOUT_MS) || 0) || 86_400_000); // default 24h (was 10min)
+    const workerMaxTurns = Math.floor(parseNumOrFailNonNegative("LEADER_WORKER_MAX_TURNS", env.LEADER_WORKER_MAX_TURNS) || 0) || 10_000;
+    const workerBudgetUsd = (parseNumOrFailNonNegative("LEADER_WORKER_BUDGET_USD", env.LEADER_WORKER_BUDGET_USD) || 0) || 100;
     const resourceSuspendOn = String(env.LEADER_RESOURCE_SUSPEND ?? "").toLowerCase() === "true";
     // Per-slice window: a fraction of the total so a worker suspends+resumes several times across its budget
     // (default = total/4, min $1). Smaller window ⇒ more, shorter slices ⇒ progress saved more often.
-    const sliceMaxCostUsd = (parseNumOrFail("LEADER_WORKER_SLICE_BUDGET_USD", env.LEADER_WORKER_SLICE_BUDGET_USD) || 0) || Math.max(1, workerBudgetUsd / 4);
+    const sliceMaxCostUsd = (parseNumOrFailNonNegative("LEADER_WORKER_SLICE_BUDGET_USD", env.LEADER_WORKER_SLICE_BUDGET_USD) || 0) || Math.max(1, workerBudgetUsd / 4);
     return {
         leaderTimeoutMs,
         workerMaxTurns,
@@ -135,24 +147,41 @@ export function leaderResourceConfig(env = process.env) {
             : {}),
     };
 }
-export function createLeaderRunner(cfg) {
-    const W = cfg.workspace ?? "/home/user";
-    const repo = `${W}/repo`;
-    const ident = cfg.git ?? { name: "leader", email: "leader@local" };
-    const { leaderTimeoutMs, workerLimits, presignTtlSec, resourceSuspend: resourceCfg } = leaderResourceConfig();
-    const repairRounds = Math.max(0, Math.floor(Number(process.env.LEADER_REPAIR_ROUNDS ?? cfg.repairRounds ?? 0)) || 0);
-    const repairBudgetUsd = Number(process.env.LEADER_REPAIR_BUDGET_USD ?? "4") || 4;
-    const conflictRounds = Math.max(0, Math.floor(Number(process.env.LEADER_CONFLICT_ROUNDS ?? cfg.conflictRounds ?? 0)) || 0);
+// 🔴 review-batch(重构池②,2026-08-01): every knob below used to be a bare `Number(process.env.X ?? default)`
+// with ZERO fail-loud guard — worst case was `LEADER_BUDGET_USD="20usd"` silently becoming `budgetUsd: NaN`,
+// which makes the replan-lite budget gate's `spent > budgetUsd` comparison permanently `false` (the whole
+// gate goes dark, not "loose" — `NaN` compares false in every direction). Converged onto the same
+// `parseNumOrFailNonNegative` primitive leaderResourceConfig uses: non-numeric and negative now throw at
+// startup; `undefined`/explicit-`0` fallback semantics are byte-identical to before.
+export function leaderLoopConfig(cfg, env = process.env) {
+    const repairRounds = Math.max(0, Math.floor(env.LEADER_REPAIR_ROUNDS !== undefined
+        ? parseNumOrFailNonNegative("LEADER_REPAIR_ROUNDS", env.LEADER_REPAIR_ROUNDS)
+        : (cfg.repairRounds ?? 0)) || 0);
+    const repairBudgetUsd = parseNumOrFailNonNegative("LEADER_REPAIR_BUDGET_USD", env.LEADER_REPAIR_BUDGET_USD ?? "4") || 4;
+    const conflictRounds = Math.max(0, Math.floor(env.LEADER_CONFLICT_ROUNDS !== undefined
+        ? parseNumOrFailNonNegative("LEADER_CONFLICT_ROUNDS", env.LEADER_CONFLICT_ROUNDS)
+        : (cfg.conflictRounds ?? 0)) || 0);
     // ── LEADER-REPAIRLOOP-INTEGRATION §10 env knobs (FRESH hunk, §10.8 — mirrors LEADER_REPAIR_ROUNDS above) ──
     // Every flag default-OFF so the whole feature is inert until flipped on a canary (the default path is
     // byte-identical to today). `LEADER_REPAIR_LOOP` is the MASTER (gates the single-agent `runRepairLoop` dep);
     // `LEADER_MEASURE_GATES` gates the merge push-hold-on-signal + measure-drives-repair (§10.3/§10.4);
     // `LEADER_REPAIR_LOOP_ATTEMPTS` is the in-loop attempt ceiling (validated 2-3, default 2 — design/78 §5);
     // `LEADER_ORACLE_FLAKY_K` is the flaky-settle re-isolation count (default 2 — §10.1 / repair-oracle.ts).
-    const repairLoopOn = String(process.env.LEADER_REPAIR_LOOP ?? "").toLowerCase() === "true";
-    const measureGatesOn = String(process.env.LEADER_MEASURE_GATES ?? "").toLowerCase() === "true";
-    const repairLoopAttempts = Math.min(3, Math.max(2, Math.floor(Number(process.env.LEADER_REPAIR_LOOP_ATTEMPTS ?? "2")) || 2));
-    const oracleFlakyK = Math.max(1, Math.floor(Number(process.env.LEADER_ORACLE_FLAKY_K ?? "2")) || 2);
+    const repairLoopOn = String(env.LEADER_REPAIR_LOOP ?? "").toLowerCase() === "true";
+    const measureGatesOn = String(env.LEADER_MEASURE_GATES ?? "").toLowerCase() === "true";
+    const repairLoopAttempts = Math.min(3, Math.max(2, Math.floor(parseNumOrFailNonNegative("LEADER_REPAIR_LOOP_ATTEMPTS", env.LEADER_REPAIR_LOOP_ATTEMPTS ?? "2")) || 2));
+    const oracleFlakyK = Math.max(1, Math.floor(parseNumOrFailNonNegative("LEADER_ORACLE_FLAKY_K", env.LEADER_ORACLE_FLAKY_K ?? "2")) || 2);
+    return {
+        repairRounds, repairBudgetUsd, conflictRounds, repairLoopOn, measureGatesOn, repairLoopAttempts, oracleFlakyK,
+        ...(env.LEADER_BUDGET_USD ? { replanBudgetUsd: parseNumOrFailNonNegative("LEADER_BUDGET_USD", env.LEADER_BUDGET_USD) } : {}),
+    };
+}
+export function createLeaderRunner(cfg) {
+    const W = cfg.workspace ?? "/home/user";
+    const repo = `${W}/repo`;
+    const ident = cfg.git ?? { name: "leader", email: "leader@local" };
+    const { leaderTimeoutMs, workerLimits, presignTtlSec, resourceSuspend: resourceCfg } = leaderResourceConfig();
+    const { repairRounds, repairBudgetUsd, conflictRounds, repairLoopOn, measureGatesOn, repairLoopAttempts, oracleFlakyK, replanBudgetUsd, } = leaderLoopConfig({ repairRounds: cfg.repairRounds, conflictRounds: cfg.conflictRounds });
     // worker resource bounds (limits/maxCostUsd) + presign ttl are derived in leaderResourceConfig(), above.
     // Bounded integration-repair (search 2026-06-14): when the merged tree compiles-clean-but-fails, run a strong
     // agent WITH HANDS in the live merged sandbox to fix the cross-worker integration, then mergeBranches re-runs
@@ -590,8 +619,9 @@ export function createLeaderRunner(cfg) {
             // found live: task02b run5, porting workers + collapse-solo all 'run aborted' at the 600s default while
             // mid-gradle; the per-worker presign ttl below tracks the same knob).
             timeoutMs: leaderTimeoutMs, maxConcurrency: 4, // Semaphore cap; the planner emits ≤6 sub-tasks
-            // replan-lite (design/68 §6) always on in the wired leader; LEADER_BUDGET_USD bounds the fan-out spend.
-            replan: { ...(process.env.LEADER_BUDGET_USD ? { budgetUsd: Number(process.env.LEADER_BUDGET_USD) } : {}) },
+            // replan-lite (design/68 §6) always on in the wired leader; LEADER_BUDGET_USD bounds the fan-out spend
+            // (parsed + fail-loud-guarded in leaderLoopConfig(), above — see LEADER_BUDGET_USD review-batch note).
+            replan: { ...(replanBudgetUsd !== undefined ? { budgetUsd: replanBudgetUsd } : {}) },
             // LEADER-REPAIRLOOP-INTEGRATION §10.3 — the merge push-hold-on-signal (OFF unless LEADER_MEASURE_GATES). It
             // needs NO extra sandbox: `strongOracleSeeded` keys on whether a hidden held-out oracle was injected into the
             // integration sandbox (`injectOracles` runs `body.oracleFiles`), and the §10.3 hold combines it with the

package/dist/main.js

@@ -24,7 +24,7 @@ import { createRegistryJwtVerifier } from "./auth-bridge.js";
 import { createMetrics } from "./observability/metrics.js";
 import { setRedactionObserver, redactSecrets } from "./trace/redact.js";
 import { RateLimiter } from "./observability/rate-limit.js";
-import { createHttpServer, explicitOperator } from "./http/server.js";
+import { createHttpServer, explicitOperatorOk } from "./http/server.js";
 import { exportMemoryScope } from "./memory-export.js";
 import { performMemorySync } from "./memory-sync.js";
 import { startOtlpExporter } from "./observability/otel-exporter.js";
@@ -421,7 +421,7 @@ async function main() {
         ? selectEnvironmentTool({
             catalog: imageIndex,
             selection: sessionEnvSelection,
-            viewerFor: (principal) => ({ operator: explicitOperator(principal, config.operatorPrincipals), tenantId: principal ?? null }),
+            viewerFor: (principal) => ({ operator: explicitOperatorOk(principal, config.operatorPrincipals), tenantId: principal ?? null }),
         })
         : undefined;
     // Sandbox-image-pool BAKE control plane (IMAGE-API-DESIGN.md §P2): enables /v1/images/bakes* when a pool exists

package/dist/parked-decide.js

@@ -135,7 +135,10 @@ export async function decideParkedAgent(deps, req) {
         boundInputHash: req.binding?.boundInputHash ?? persistedHash,
         decision: req.decision === "approve" ? "allow" : "deny",
         ...(req.decision === "approve" && req.binding?.updatedInput !== undefined ? { updatedInput: req.binding.updatedInput } : {}),
-        ...(req.reason ? { reason: req.reason } : {}),
+        // B10:存在性判定,不是真值判定 —— reason 可以是空串("运维显式选择不写理由"),这与"没传 reason"
+        // 是两件不同的事(姊妹 approval-hmac.ts `env.reason ?? null` 同判据:`??` 只在 null/undefined 时落
+        // null,空串照样入签名载荷)。真值判定会把显式 "" 与缺席折成同一个结果,审计/签名面丢了这个区分。
+        ...(req.reason !== undefined ? { reason: req.reason } : {}),
     };
     const ctx = {
         toolCallId: `drv-${ticket.claimId}`,

package/dist/plugins/file-run-store.js

@@ -363,9 +363,9 @@ export class FileRunStore {
         const cursorAt = opts.cursor ? Date.parse(opts.cursor.createdAt) : undefined;
         const rows = [...this.runs.values()]
             .filter((r) => (opts.status ? r.status === opts.status : true))
-            .filter((r) => (opts.jobId ? r.jobId === opts.jobId : true))
-            .filter((r) => (opts.source ? r.source === opts.source : true))
-            .filter((r) => (opts.owner ? r.owner === opts.owner : true)) // exact (SQL `owner = ?`): a set owner excludes null-owner rows
+            .filter((r) => (opts.jobId !== undefined ? r.jobId === opts.jobId : true)) // "" is a valid exact jobId, not "no filter" (B10)
+            .filter((r) => (opts.source !== undefined ? r.source === opts.source : true)) // "" is a valid exact source, not "no filter" (B10)
+            .filter((r) => (opts.owner !== undefined ? r.owner === opts.owner : true)) // exact (SQL `owner = ?`): "" is a valid exact owner, not "no filter" (B10)
             .filter((r) => {
             if (cursorAt === undefined)
                 return true;
@@ -379,8 +379,8 @@ export class FileRunStore {
     async listSessions(opts) {
         const bySession = new Map();
         for (const r of this.runs.values()) {
-            if (opts.owner && r.owner !== opts.owner)
-                continue; // exact owner filter (SQL `owner = ?`)
+            if (opts.owner !== undefined && r.owner !== opts.owner)
+                continue; // exact owner filter (SQL `owner = ?`); "" is a valid exact owner (B10)
             const arr = bySession.get(r.sessionId) ?? [];
             arr.push(r);
             bySession.set(r.sessionId, arr);

package/dist/plugins/host-platform.d.ts

@@ -1,27 +1,3 @@
-/**
- * Host-lane PLATFORM seam (DESIGN-windows-native.md, FINAL r3) — the ONE place the host exec adapter's
- * POSIX/win32 differences live, so `remote-env-host.ts` stays a single code path with platform-gated leaves.
- *
- * 🔴 Iron invariant (design §4.1): the POSIX path is BYTE-IDENTICAL to the pre-Windows code — every helper is
- * `win32 ? new : exactly-what-the-inline-code-did` (same syscall, same throw behavior). Never "improve" POSIX
- * here; the existing full test suite is the regression net.
- *
- * win32 semantics (design D1-D4):
- *  - shell   = Git Bash via core 1.224 `getShellConfig` (WSL-launcher-filtered — the `System32\bash.exe`
- *              trap). Fail-LOUD when absent; never silently degrade to cmd (D1).
- *  - kill    = core 1.224 `signalProcessTree` (taskkill /T, /F for hard). Soft is a no-op for console trees
- *              (taskkill errors "can only be terminated forcefully") — the SIGTERM→grace→SIGKILL ladder is
- *              effectively delay→hard-kill on win32; accepted, CC-identical (D2).
- *  - spawn   = `detached:false` + `windowsHide:true` (no console window; no POSIX process group — the kill
- *              side uses the tree, not the group) (D3).
- *  - env     = case-insensitive key collapse before spawn (win32 env keys are case-insensitive; a `Path`+`PATH`
- *              pair from case-sensitive Object.assign reaches CreateProcess as ONE undefined-which
- *              entry). Canonical casing = the first-seen key (process.env's native casing wins since the
- *              inherit base is spread first).
- *
- * ⚠️ The win32 branches are UNVERIFIED on a real machine until S5 (Windows CI runner) — design D5 discipline:
- * structural tests only on mac/Linux; behavior-level bite happens on the first Windows-runner green.
- */
 import { killProcessTree } from "@sema-agent/core";
 export declare const IS_WIN32: boolean;
 export interface HostShell {
@@ -82,6 +58,17 @@ export { killProcessTree };
  * POSIX: returns the input UNTOUCHED (case-sensitive env is real there — `Path` and `PATH` are distinct).
  */
 export declare function collapseWin32EnvKeys(env: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+/**
+ * Conventional exit-code mapping for a process killed by a signal (128 + signal number). Single pattern-home
+ * construction point for every exec adapter that must turn a `close` event's external-kill case
+ * (`code===null`, `signal` set) into an exit code instead of silently reporting a fake success 0 — the host
+ * lane, ssh, adb, and local-docker all consume THIS function; none of them may hand-write their own signal
+ * table. Uses Node's authoritative platform table (`os.constants.signals`) rather than a hand-written list —
+ * a hand-written table has previously missed `SIGABRT`/`SIGPIPE` (`kill -ABRT` reported 137, impersonating
+ * `SIGKILL`). Callers keep a `?? 9` fallback for a name the platform table doesn't define, matching core's
+ * `SIGNUM[signal] ?? 9`.
+ */
+export declare function signalNumber(signal: NodeJS.Signals): number | undefined;
 /** The platform-free collapse algorithm (exported so the mac/Linux suite can pin the win32 behavior — design
  *  D5: structural verification everywhere, behavioral bite on the Windows runner). */
 export declare function collapseEnvKeysCaseInsensitive(env: NodeJS.ProcessEnv): NodeJS.ProcessEnv;

package/dist/plugins/host-platform.js

@@ -22,6 +22,7 @@
  * ⚠️ The win32 branches are UNVERIFIED on a real machine until S5 (Windows CI runner) — design D5 discipline:
  * structural tests only on mac/Linux; behavior-level bite happens on the first Windows-runner green.
  */
+import os from "node:os";
 import { getShellConfig, killProcessTree, signalProcessTree } from "@sema-agent/core";
 export const IS_WIN32 = process.platform === "win32";
 /** S1([1870] test AI 全归因,2026-07-27):POSIX 不再硬编码 `/bin/sh`——Debian/Ubuntu 的 /bin/sh 是
@@ -135,6 +136,19 @@ export function collapseWin32EnvKeys(env) {
         return env;
     return collapseEnvKeysCaseInsensitive(env);
 }
+/**
+ * Conventional exit-code mapping for a process killed by a signal (128 + signal number). Single pattern-home
+ * construction point for every exec adapter that must turn a `close` event's external-kill case
+ * (`code===null`, `signal` set) into an exit code instead of silently reporting a fake success 0 — the host
+ * lane, ssh, adb, and local-docker all consume THIS function; none of them may hand-write their own signal
+ * table. Uses Node's authoritative platform table (`os.constants.signals`) rather than a hand-written list —
+ * a hand-written table has previously missed `SIGABRT`/`SIGPIPE` (`kill -ABRT` reported 137, impersonating
+ * `SIGKILL`). Callers keep a `?? 9` fallback for a name the platform table doesn't define, matching core's
+ * `SIGNUM[signal] ?? 9`.
+ */
+export function signalNumber(signal) {
+    return os.constants.signals[signal];
+}
 /** The platform-free collapse algorithm (exported so the mac/Linux suite can pin the win32 behavior — design
  *  D5: structural verification everywhere, behavioral bite on the Windows runner). */
 export function collapseEnvKeysCaseInsensitive(env) {

package/dist/plugins/memory-engine-tidb.js

@@ -23,6 +23,7 @@
 //     (`${name ?? slug} ${description} ${body}`——memoryBackendContract 的 search 等价断言依赖)。
 import { jaccardDistance, termSet } from "./memory-engine-vector-util.js";
 import { computeEntryRev, serializeEntryFile } from "@sema-agent/core";
+import { pgHasUnstorable } from "./pg-safe-json.js";
 /** Table names (single source) — SAME names as PG_MEMORY_ENGINE_TABLES (the two dialects never share
  *  one database), deliberately DISJOINT from the legacy `agent_memory*` MemoryStore plane. */
 export const TIDB_MEMORY_ENGINE_TABLES = {
@@ -224,6 +225,15 @@ export class TiDBMemoryEngineBackend {
                 report.conflicts.push({ op: "add", id: patch.id, reason: "add patch without an entry" });
                 return;
             }
+            // Reject-not-rewrite for bytes SQL cannot store(Pg 版 applyOne add 分支同一守卫,复用同一
+            // pgHasUnstorable——不是重派生一份近似正则):NUL / 孤立 UTF-16 代理不是 PG 独有的病,mysql2/
+            // utf8mb4 对同样的字节没有 PG 的 22P05 fail-loud 报错,驱动或服务端会静默 mangle(丢字节/替换为
+            // U+FFFD 视驱动版本而定),写入侧不炸、读回侧才发现内容偏离——这比 PG 的写时报错更隐蔽。三后端
+            // (pg/tidb/local)必须对同一输入给出同一行为,否则同一份 sync 数据在不同部署形态下悄悄分叉。
+            if (pgHasUnstorable(entry.frontmatter) || pgHasUnstorable(entry.body) || pgHasUnstorable(entry.slug)) {
+                report.conflicts.push({ op: "add", id: entry.id, reason: "unstorable_bytes (utf8mb4 cannot store NUL/lone surrogates without mangling; strip them at the source — the store never rewrites content)" });
+                return;
+            }
             // Cross-scope add refusal (opus 审 C3,Pg 版同注): an add whose id already lives in a DIFFERENT
             // scope must not silently MOVE the row; same-scope re-add stays the idempotent overwrite.
             // One probe serves BOTH the E-02 guard and the cross-scope refusal (File/Pg parity).
@@ -369,6 +379,12 @@ export class TiDBMemoryEngineBackend {
             report.conflicts.push({ op: "update", id: patch.id, reason: "update patch without an entry" });
             return;
         }
+        // Same reject-not-rewrite guard as the add leg above(Pg 版 applyOne update 分支同一守卫)—
+        // an update carrying unstorable bytes must refuse before the CAS write, not mangle silently.
+        if (pgHasUnstorable(entry.frontmatter) || pgHasUnstorable(entry.body) || pgHasUnstorable(entry.slug)) {
+            report.conflicts.push({ op: "update", id: patch.id, reason: "unstorable_bytes (utf8mb4 cannot store NUL/lone surrogates without mangling; strip them at the source — the store never rewrites content)" });
+            return;
+        }
         const rev = computeEntryRev(entry);
         const res = await this.write(`UPDATE ${T} SET scope = ?, slug = ?, frontmatter = ?, body = ?, rev = ?, mtime_ms = ?, size_bytes = ?, embedding = NULL WHERE id = ? AND rev = ?`, [entry.scope, entry.slug, JSON.stringify(entry.frontmatter), entry.body, rev, this.clock(), Buffer.byteLength(serializeEntryFile(entry), "utf8"), entry.id, currentRev]);
         if (res.affectedRows === 0) {

package/dist/plugins/memory-run-store.js

@@ -191,9 +191,9 @@ export class MemoryRunStore {
         const cursorAt = opts.cursor ? Date.parse(opts.cursor.createdAt) : undefined;
         const rows = [...this.runs.values()]
             .filter((r) => (opts.status ? r.status === opts.status : true))
-            .filter((r) => (opts.jobId ? r.jobId === opts.jobId : true))
-            .filter((r) => (opts.source ? r.source === opts.source : true))
-            .filter((r) => (opts.owner ? r.owner === opts.owner : true)) // exact (SQL `owner = ?`): a set owner excludes null-owner rows
+            .filter((r) => (opts.jobId !== undefined ? r.jobId === opts.jobId : true)) // "" is a valid exact jobId, not "no filter" (B10)
+            .filter((r) => (opts.source !== undefined ? r.source === opts.source : true)) // "" is a valid exact source, not "no filter" (B10)
+            .filter((r) => (opts.owner !== undefined ? r.owner === opts.owner : true)) // exact (SQL `owner = ?`): "" is a valid exact owner, not "no filter" (B10)
             .filter((r) => {
             if (cursorAt === undefined)
                 return true;
@@ -207,8 +207,8 @@ export class MemoryRunStore {
     async listSessions(opts) {
         const bySession = new Map();
         for (const r of this.runs.values()) {
-            if (opts.owner && r.owner !== opts.owner)
-                continue; // exact owner filter (SQL `owner = ?`)
+            if (opts.owner !== undefined && r.owner !== opts.owner)
+                continue; // exact owner filter (SQL `owner = ?`); "" is a valid exact owner (B10)
             const arr = bySession.get(r.sessionId) ?? [];
             arr.push(r);
             bySession.set(r.sessionId, arr);

package/dist/plugins/remote-env-adb.js

@@ -29,6 +29,7 @@ import os from "node:os";
 import fs from "node:fs/promises";
 import { spawn } from "node:child_process";
 import { shellQuote, armPipeDestroyGrace } from "./remote-shell.js";
+import { signalNumber } from "./host-platform.js";
 import { FileError, ExecutionError, RemoteExecutionError, withRetry, RollingTailBuffer, markTruncated, } from "@sema-agent/core";
 import { fileErrorFromExec } from "./remote-env-file-error.js";
 import { createPosixShellFs } from "./posix-shell-fs.js";
@@ -234,13 +235,15 @@ export class RemoteAdbExecutionEnv {
             finished = true;
             signalReady();
         });
-        child.on("close", (code) => {
+        child.on("close", (code, signal) => {
             if ((code ?? 0) !== 0 && isAdbTransportLost(stderrTail) && !failure) {
                 // device transport died mid-stream — typed retryable, not a fake exit ([R78]#1)
                 this.connected = false;
                 failure = new RemoteExecutionError("transport_lost", `adb transport lost mid-stream: ${stderrTail.trim().slice(0, 200)}`);
             }
-            exitCode = code ?? 0;
+            // code==null WITH a signal = the adb child was killed by an external signal (SIGKILL/OOM) — conventional
+            // 128+signo, NOT a fake success 0 ([R78]#2; the second `close` argument was dropped before this fix).
+            exitCode = code ?? (signal ? 128 + (signalNumber(signal) ?? 9) : 0);
             finished = true;
             signalReady();
         });
@@ -483,19 +486,23 @@ export class RemoteAdbExecutionEnv {
                 opts?.onStderr?.(d.toString());
             });
             child.on("error", (e) => finish({ ok: false, error: new ExecutionError("spawn_error", `adb spawn failed (is '${this.cfg.adbPath}' installed?): ${e.message}`, e) }));
-            child.on("close", (code) => {
+            child.on("close", (code, signal) => {
                 if (forceSettleTimer)
                     clearTimeout(forceSettleTimer); // `close` fired → pipes closed naturally; clear D5 grace
                 const err = errBuf.result();
                 const stderr = markTruncated(err.text, err.droppedBytes);
+                // code==null WITH a signal = the adb child was killed by an external signal (SIGKILL/OOM) —
+                // conventional 128+signo, NOT a fake success 0 ([R78]#2; the second `close` argument was dropped
+                // before this fix).
+                const exitCode = code ?? (signal ? 128 + (signalNumber(signal) ?? 9) : 0);
                 if (binary) {
                     // byte-exact: readBinaryFile decodes stdoutBytes; never truncate.
                     const stdoutBytes = Buffer.concat(outBufs);
-                    finish(ok({ stdout: stdoutBytes.toString("utf8"), stderr, exitCode: code ?? 0, stdoutBytes: new Uint8Array(stdoutBytes) }));
+                    finish(ok({ stdout: stdoutBytes.toString("utf8"), stderr, exitCode, stdoutBytes: new Uint8Array(stdoutBytes) }));
                 }
                 else {
                     const out = outTail.result();
-                    finish(ok({ stdout: markTruncated(out.text, out.droppedBytes), stderr, exitCode: code ?? 0 }));
+                    finish(ok({ stdout: markTruncated(out.text, out.droppedBytes), stderr, exitCode }));
                 }
             });
         });

package/dist/plugins/remote-env-local-docker.js

@@ -42,6 +42,7 @@ import fs from "node:fs/promises";
 import { spawn } from "node:child_process";
 import { randomBytes } from "node:crypto";
 import { shellQuote, armPipeDestroyGrace } from "./remote-shell.js";
+import { signalNumber } from "./host-platform.js";
 import { FileError, ExecutionError, RemoteExecutionError, RollingTailBuffer, markTruncated, } from "@sema-agent/core";
 import { fileErrorFromExec, classifyFsStderr } from "./remote-env-file-error.js";
 import { createPosixShellFs } from "./posix-shell-fs.js";
@@ -290,7 +291,7 @@ export class RemoteLocalDockerExecutionEnv {
         child.on("close", (code, signal) => {
             if (finished)
                 return;
-            exitCode = code ?? (signal ? 128 + (signalNumber(signal) ?? 0) : 1);
+            exitCode = code ?? (signal ? 128 + (signalNumber(signal) ?? 9) : 1);
             finished = true;
             signalReady();
         });
@@ -586,7 +587,7 @@ export class RemoteLocalDockerExecutionEnv {
                     clearTimeout(forceSettleTimer); // `close` fired → pipes closed naturally; clear D5 grace
                 // A signal-killed process (external SIGKILL/OOM) has code===null → derive the conventional 128+signo
                 // (parity with execStream + the host adapter); NEVER report a killed command as a success exitCode 0.
-                const exitCode = code ?? (signal ? 128 + (signalNumber(signal) ?? 0) : 1);
+                const exitCode = code ?? (signal ? 128 + (signalNumber(signal) ?? 9) : 1);
                 const err = errBuf.result();
                 const stderr = markTruncated(err.text, err.droppedBytes);
                 if (binary) {
@@ -664,11 +665,6 @@ function sanitizeId(id) {
 function errMsg(e) {
     return e instanceof Error ? e.message : String(e);
 }
-/** Conventional exit code for a process killed by a signal (128 + signal number); falls back to undefined. */
-function signalNumber(signal) {
-    const table = { SIGHUP: 1, SIGINT: 2, SIGQUIT: 3, SIGKILL: 9, SIGTERM: 15, SIGSEGV: 11 };
-    return table[signal];
-}
 /**
  * `ExecutionEnvFactory` for the TOC `local-docker` backend (DUAL-MODE-DESIGN §5). Wiring this onto a deployment
  * makes its agent run each task in a per-task container on the worker's OWN docker daemon (isolation:true,

package/dist/plugins/remote-env-ssh.js

@@ -22,6 +22,7 @@
 import path from "node:path";
 import { Client } from "ssh2";
 import { shellQuote, kindFromMode } from "./remote-shell.js";
+import { signalNumber } from "./host-platform.js";
 import { createPosixShellFs } from "./posix-shell-fs.js";
 import { FileError, ExecutionError, RemoteExecutionError, withRetry, RollingTailBuffer, markTruncated, } from "@sema-agent/core";
 import { fileErrorFromExec } from "./remote-env-file-error.js";
@@ -31,6 +32,13 @@ const unsupported = (op) => ({
     ok: false,
     error: new RemoteExecutionError("unsupported", `${op} is not supported on an SSH target (real machine — not snapshotable; capabilities.suspendable=false)`),
 });
+/** ssh2's ClientChannel "close" event gives the killing signal's BARE POSIX name (e.g. "KILL"), unlike Node's
+ *  own `child.on("close")` which gives `NodeJS.Signals` names (e.g. "SIGKILL") — re-prefix before looking it
+ *  up in the shared, authoritative signal table (host-platform.ts `signalNumber`; single pattern-home, no
+ *  hand-written table here). `?? 9` matches the convention every other exec adapter uses for an unmapped name. */
+function exitCodeForSignalKill(signal) {
+    return 128 + (signalNumber(`SIG${signal}`) ?? 9);
+}
 export class RemoteSshExecutionEnv {
     capabilities = { isolation: false, suspendable: false };
     /** Working directory; relative paths resolve against it (ExecutionEnv contract). Starts at mountPath. */
@@ -341,7 +349,12 @@ export class RemoteSshExecutionEnv {
                     }
                     const out = outBuf.result();
                     const err = errBuf.result();
-                    finish(ok({ stdout: markTruncated(out.text, out.droppedBytes), stderr: markTruncated(err.text, err.droppedBytes), exitCode: code ?? 0 }));
+                    // code==null WITH a signal = the remote command was killed by that signal — conventional 128+signo,
+                    // NOT a fake success 0 ([R78]#2; was silently mapped to exitCode 0 before this fix). The `: 1`
+                    // arm is unreachable (the transport_lost return above already covers code==null && !signal) but
+                    // keeps the type honest without a non-null assertion.
+                    const exitCode = code ?? (signal ? exitCodeForSignalKill(signal) : 1);
+                    finish(ok({ stdout: markTruncated(out.text, out.droppedBytes), stderr: markTruncated(err.text, err.droppedBytes), exitCode }));
                 })
                     .stderr.on("data", (d) => {
                     errBuf.push(d);
@@ -445,7 +458,9 @@ export class RemoteSshExecutionEnv {
                     // channel died without an exit status (transport drop) — typed retryable, not a fake exit 0 ([R78]#1)
                     failure = new RemoteExecutionError("transport_lost", "ssh channel closed without exit status (transport lost)");
                 }
-                exitCode = code ?? 0;
+                // code==null WITH a signal = the remote command was killed by that signal — conventional 128+signo,
+                // NOT a fake success 0 ([R78]#2; was silently mapped to exitCode 0 before this fix).
+                exitCode = code ?? (signal ? exitCodeForSignalKill(signal) : 0);
                 finished = true;
                 signalReady();
             })

package/dist/plugins/run-store-sql.js

@@ -289,16 +289,16 @@ export class SqlRunStore {
                 where.push("status = ?");
                 params.push(opts.status);
             }
-            if (opts.jobId) {
+            if (opts.jobId !== undefined) {
                 where.push("job_id = ?");
                 params.push(opts.jobId);
             }
-            if (opts.source) {
+            if (opts.source !== undefined) {
                 where.push("source = ?");
                 params.push(opts.source);
             }
-            if (opts.owner) {
-                where.push("owner = ?"); // idx_owner — the per-user list view (portal scopes a normal user to their own)
+            if (opts.owner !== undefined) {
+                where.push("owner = ?"); // idx_owner — the per-user list view (portal scopes a normal user to their own); "" is a valid exact owner, not "no filter" (B10)
                 params.push(opts.owner);
             }
             if (opts.cursor) {
@@ -320,12 +320,12 @@ export class SqlRunStore {
         const where = [];
         if (opts.status)
             where.push(`status = ${p(opts.status)}`);
-        if (opts.jobId)
+        if (opts.jobId !== undefined)
             where.push(`job_id = ${p(opts.jobId)}`);
-        if (opts.source)
-            where.push(`source = ${p(opts.source)}`);
-        if (opts.owner)
-            where.push(`owner = ${p(opts.owner)}`);
+        if (opts.source !== undefined)
+            where.push(`source = ${p(opts.source)}`); // "" exact-matches (B10, same family as owner)
+        if (opts.owner !== undefined)
+            where.push(`owner = ${p(opts.owner)}`); // "" is a valid exact owner, not "no filter" (B10)
         if (opts.cursor) {
             const a = p(new Date(opts.cursor.createdAt));
             const b = p(new Date(opts.cursor.createdAt));
@@ -348,8 +348,8 @@ export class SqlRunStore {
         if (this.db.dialect === "tidb") {
             const params = [];
             let innerWhere = "";
-            if (opts.owner) {
-                innerWhere = " WHERE owner = ?";
+            if (opts.owner !== undefined) {
+                innerWhere = " WHERE owner = ?"; // "" is a valid exact owner, not "no filter" (B10)
                 params.push(opts.owner);
             }
             const outer = ["rn = 1"];
@@ -381,7 +381,7 @@ export class SqlRunStore {
             params.push(v);
             return `$${params.length}`;
         };
-        const innerWhere = opts.owner ? ` WHERE owner = ${p(opts.owner)}` : "";
+        const innerWhere = opts.owner !== undefined ? ` WHERE owner = ${p(opts.owner)}` : ""; // "" is a valid exact owner, not "no filter" (B10)
         const outer = ["rn = 1"];
         // `?q=` — the PG twin of the TiDB EXISTS predicate above.
         if (opts.q)

package/dist/plugins/store-backend.d.ts

@@ -144,7 +144,7 @@ export interface StoreBackend {
     /** P1 (fleet failover): durable cross-replica WorkflowRunStore + completion-inbox twins. OPTIONAL —
      *  SQL backends only (local keeps the File pair: single box, no cross-replica surface). main.ts prefers
      *  these under WORKFLOW_RUN_STORE=auto (the default). */
-    workflowRun?(): import("@sema-agent/core").WorkflowRunStore;
+    workflowRun?(onWarn?: InboxWarn): import("@sema-agent/core").WorkflowRunStore;
     completionInbox?(onWarn?: InboxWarn): import("../orchestration/workflow-completion-inbox.js").WorkflowCompletionInbox;
     /** 1.108 review fix (lens③ HIGH): the notify-JOURNAL twin — third leg of the same axis (a SQL run store +
      *  inbox with a replica-LOCAL File journal stranded a dead replica's un-acked notify forever). */

package/dist/plugins/store-backend.js

@@ -113,7 +113,7 @@ class TiDBBackend {
     fileSnapshot() { return new TiDBFileSnapshotStore(this.pool, snapshotBlobBackend(this.config, "tidb", this.pool), snapshotBoundsFromConfig(this.config)); }
     workflowJournal() { return new TiDBWorkflowJournalStore(this.pool); }
     outcomeSink() { return new TiDBOutcomeLedger(this.pool); } // design/73 §1→§7 bridge (recordCore)
-    workflowRun() { return new TiDBWorkflowRunStore(this.pool); } // P1: cross-replica workflow record
+    workflowRun(onWarn) { return new TiDBWorkflowRunStore(this.pool, onWarn); } // P1: cross-replica workflow record(onWarn = C5 oversize-slim 留痕,completionInbox 同款先例)
     completionInbox(onWarn) { return new TiDBWorkflowCompletionInbox(this.pool, onWarn); } // P1: cross-replica push half
     notifyJournal() { return new TiDBWorkflowNotifyJournalStore(this.pool); } // 1.108: cross-replica at-least-once notify
     checkpoint(logger) { return new TiDBCheckpointStore(this.pool, logger); }
@@ -147,7 +147,7 @@ class PgBackend {
     fileSnapshot() { return new PgFileSnapshotStore(this.pool, snapshotBlobBackend(this.config, "pg", this.pool), snapshotBoundsFromConfig(this.config)); }
     workflowJournal() { return new PgWorkflowJournalStore(this.pool); }
     outcomeSink() { return new PgOutcomeLedger(this.pool); } // design/73 §1→§7 bridge (recordCore)
-    workflowRun() { return new PgWorkflowRunStore(this.pool); } // P1: cross-replica workflow record
+    workflowRun(onWarn) { return new PgWorkflowRunStore(this.pool, onWarn); } // P1: cross-replica workflow record(onWarn = C5 oversize-slim 留痕,completionInbox 同款先例)
     completionInbox(onWarn) { return new PgWorkflowCompletionInbox(this.pool, onWarn); } // P1: cross-replica push half
     notifyJournal() { return new PgWorkflowNotifyJournalStore(this.pool); } // 1.108: cross-replica at-least-once notify
     checkpoint(logger) { return new PgCheckpointStore(this.pool, logger); }

package/dist/plugins/tool-result-store-sql.d.ts

@@ -29,7 +29,13 @@ export declare class SqlToolResultStore implements ToolResultStore {
         offset?: number;
         limit?: number;
     }): Promise<ToolResultSlice | undefined>;
-    /** TTL reap: delete results older than `cutoffMs`. Returns rows removed. */
+    /** TTL reap: delete results older than `cutoffMs`. Returns rows removed.
+     *  C6: a real DB error must NOT collapse into the same `0` a legitimate "nothing was old enough" returns —
+     *  those are different facts (query failed vs. query succeeded on an empty set) and folding them together
+     *  makes a stuck/broken reaper indistinguishable from a healthy quiet one. Matches every sibling reaper's
+     *  form (roster-store-sql.ts `reapOlderThan`, checkpoint-store-sql.ts `reapExpired`,
+     *  workflow-journal-store-sql.ts `reapExpired`): let the error propagate — the periodic-sweep call site
+     *  (boot/reapers.ts) already wraps this call in `.catch(() => undefined)` so the reap loop itself never dies. */
     reapOlderThan(cutoffMs: number): Promise<number>;
     /**
      * E21 (§0.5 session delete) — purge offloaded tool results for one session. core namespaces every ref as

package/dist/plugins/tool-result-store-sql.js

@@ -123,15 +123,16 @@ export class SqlToolResultStore {
             return undefined; // unknown ref (e.g. reaped) → core reports "no longer available"
         return { content: String(rows[0].slice ?? ""), offset, totalChars: Number(rows[0].total) };
     }
-    /** TTL reap: delete results older than `cutoffMs`. Returns rows removed. */
+    /** TTL reap: delete results older than `cutoffMs`. Returns rows removed.
+     *  C6: a real DB error must NOT collapse into the same `0` a legitimate "nothing was old enough" returns —
+     *  those are different facts (query failed vs. query succeeded on an empty set) and folding them together
+     *  makes a stuck/broken reaper indistinguishable from a healthy quiet one. Matches every sibling reaper's
+     *  form (roster-store-sql.ts `reapOlderThan`, checkpoint-store-sql.ts `reapExpired`,
+     *  workflow-journal-store-sql.ts `reapExpired`): let the error propagate — the periodic-sweep call site
+     *  (boot/reapers.ts) already wraps this call in `.catch(() => undefined)` so the reap loop itself never dies. */
     async reapOlderThan(cutoffMs) {
-        try {
-            const { affected } = await this.db.query(this.q("DELETE FROM tool_result WHERE created_at < ?", "DELETE FROM tool_result WHERE created_at < $1"), [new Date(cutoffMs)]);
-            return affected;
-        }
-        catch {
-            return 0; // best-effort reaper — never throw into the loop
-        }
+        const { affected } = await this.db.query(this.q("DELETE FROM tool_result WHERE created_at < ?", "DELETE FROM tool_result WHERE created_at < $1"), [new Date(cutoffMs)]);
+        return affected;
     }
     /**
      * E21 (§0.5 session delete) — purge offloaded tool results for one session. core namespaces every ref as

package/dist/plugins/workflow-run-store-sql.d.ts

@@ -79,10 +79,13 @@ export declare function slimOversizeRun(run: WorkflowRun & {
     id: string;
     scope: string;
 }, maxBytes: number): string | null;
-/** Dual-dialect durable `WorkflowRunStore`. See the file header for the dialect-delta ledger. */
+/** Dual-dialect durable `WorkflowRunStore`. See the file header for the dialect-delta ledger.
+ *  `onWarn` (optional, same shape as the completion-inbox's {@link InboxWarn}) is the C5 trace channel for
+ *  `update`'s oversize-slim degrade (see there) — omit it and construction/behavior is unchanged (additive). */
 export declare class SqlWorkflowRunStore implements WorkflowRunStore {
     protected readonly db: SqlDriver;
-    constructor(db: SqlDriver);
+    private readonly onWarn?;
+    constructor(db: SqlDriver, onWarn?: InboxWarn | undefined);
     /** Pick the dialect's SQL text. Both statements stay written out at the call site ON PURPOSE. */
     private q;
     put(id: string, run: WorkflowRun): Promise<void>;
@@ -145,9 +148,10 @@ export declare class SqlWorkflowNotifyJournalStore implements WorkflowNotifyJour
     reapAcked(before: number): Promise<number>;
     get(runId: string): Promise<WorkflowNotifyJournalEntry | null>;
 }
-/** MySQL-protocol (TiDB) bindings — historical class names + ctor shapes preserved. */
+/** MySQL-protocol (TiDB) bindings — historical class names preserved; `onWarn` is an ADDITIVE optional 2nd
+ *  ctor arg (existing 1-arg call sites are unaffected — see {@link SqlWorkflowRunStore}'s C5 trace channel). */
 export declare class TiDBWorkflowRunStore extends SqlWorkflowRunStore {
-    constructor(pool: MySqlPool);
+    constructor(pool: MySqlPool, onWarn?: InboxWarn);
 }
 export declare class TiDBWorkflowCompletionInbox extends SqlWorkflowCompletionInbox {
     constructor(pool: MySqlPool, onWarn?: InboxWarn);
@@ -155,9 +159,10 @@ export declare class TiDBWorkflowCompletionInbox extends SqlWorkflowCompletionIn
 export declare class TiDBWorkflowNotifyJournalStore extends SqlWorkflowNotifyJournalStore {
     constructor(pool: MySqlPool);
 }
-/** PostgreSQL bindings — historical class names + ctor shapes preserved. */
+/** PostgreSQL bindings — historical class names preserved; `onWarn` is an ADDITIVE optional 2nd ctor arg
+ *  (existing 1-arg call sites are unaffected — see {@link SqlWorkflowRunStore}'s C5 trace channel). */
 export declare class PgWorkflowRunStore extends SqlWorkflowRunStore {
-    constructor(pool: PgPool);
+    constructor(pool: PgPool, onWarn?: InboxWarn);
 }
 export declare class PgWorkflowCompletionInbox extends SqlWorkflowCompletionInbox {
     constructor(pool: PgPool, onWarn?: InboxWarn);