@sema-agent/server 7.1.0 → 7.3.0

package/dist/boot/reapers.d.ts

@@ -21,6 +21,36 @@ import type { Metrics } from "../observability/metrics.js";
 import type { WorkflowNotifyGate, WorkflowNotifyJournalStore } from "../orchestration/workflow-notify-journal.js";
 import type { TaskAttachmentStore } from "../plugins/task-attachment-store.js";
 import type { CheckpointStoreFull, CostQuotaStore, ImageBake, RateLimiterStore, ServiceWorkflowJournalStore, StoreBackend, ToolResultStoreFull } from "../plugins/store-backend.js";
+import type { ToolApprovalCoordinator } from "../tool-approval.js";
+/** #157 / [2762]§五(sema-comms `audits/failopen-governance-176.md` §7 "Z 类 1 条"):default consecutive-failure
+ *  count before a reaper leg's swallowed error gets a `warn` line. The ~15 `.catch(() => undefined)` sites
+ *  below are correct in DIRECTION (a hiccuping periodic sweep must never crash the whole tick loop — one bad
+ *  leg cannot be allowed to starve its ~15 siblings), but were zero-observability: an operator watching only
+ *  `warn`/`error` would never learn a leg had been silently broken for days. `5` (not `1`) is deliberate —
+ *  a transient blip (one DB reconnect, one timeout) is exactly what fail-open exists to absorb without noise;
+ *  only a STREAK crosses into "diagnosable, not transient". Exported so a future per-leg override is a
+ *  constructor-arg change, not a magic-number hunt. */
+export declare const REAPER_FAILURE_WARN_THRESHOLD = 5;
+/** The pair of hooks {@link createThrottledReaperCatch} returns — `onSuccess` resets the streak (call on the
+ *  chain's fulfilled path), `onError` is the `.catch()`-equivalent rejection handler (throttled, never rethrows). */
+export interface ThrottledReaperCatch {
+    onSuccess: () => void;
+    onError: (err: unknown) => void;
+}
+/**
+ * Builds a NAMED, stateful throttle for one reaper leg: attach as `.then(() => guard.onSuccess(), guard.onError)`
+ * in place of a bare `.catch(() => undefined)` (the two-arg `.then` form still catches a rejection from any
+ * earlier link in the chain — same coverage as the `.catch()` it replaces — while also observing the FULFILLED
+ * path, which a plain `.catch()` cannot). Behavior this closure owns, unchanged reaper scheduling/cleanup:
+ *  - a successful run resets the consecutive-failure streak to 0 (one hiccup mid-outage doesn't inflate the count);
+ *  - a failure increments the streak; only once the streak reaches `threshold` (default
+ *    {@link REAPER_FAILURE_WARN_THRESHOLD}) does ONE `warn` line fire (reaper name + streak length + the most
+ *    recent error's message) — then the streak resets to 0 so a STILL-broken leg reports again after another
+ *    full `threshold` run, rather than going silent forever after its first report.
+ * One instance must be created ONCE per named leg (outside the tick's `setInterval` callback) so the streak
+ * survives across ticks — a fresh instance per tick would never accumulate past 1.
+ */
+export declare function createThrottledReaperCatch(name: string, logger: Logger, threshold?: number): ThrottledReaperCatch;
 export interface ReapersCtx {
     config: ServiceConfig;
     logger: Logger;
@@ -44,6 +74,10 @@ export interface ReapersCtx {
     rosterStore: RunnerDeps["rosterStore"];
     backgroundAgentStore: RunnerDeps["backgroundAgentStore"];
     mailboxStore: RunnerDeps["mailboxStore"];
+    /** #151 车6:流内审批撤卡帧的 live 投递口(收敛器/孤儿代打腿产出的帧经它反查 broker 的活连接)。
+     *  `TOOL_APPROVAL_ENABLED=false` 的部署恒 undefined ⇒ 收敛器照常收敛,只是不发通知帧(壳侧靠
+     *  重连 preamble 对账,见 approval-card.ts 的 `ApprovalRevokeFrame` 顶注)。 */
+    toolApproval: ToolApprovalCoordinator | undefined;
     /** 晚绑(server 造出来才有)——见文件头「位置即契约」①。 */
     getRunDenySweep: () => ((now: number) => Promise<void>) | undefined;
 }

package/dist/boot/reapers.js

@@ -15,9 +15,66 @@
 import { Runner, defaultTaskRegistry } from "@sema-agent/core";
 import { sweepStaleScratchpads } from "../env-facts.js";
 import { CostQuota } from "../observability/cost-quota.js";
+import { createApprovalReconciler } from "../approval-reconciler.js";
+/** #157 / [2762]§五(sema-comms `audits/failopen-governance-176.md` §7 "Z 类 1 条"):default consecutive-failure
+ *  count before a reaper leg's swallowed error gets a `warn` line. The ~15 `.catch(() => undefined)` sites
+ *  below are correct in DIRECTION (a hiccuping periodic sweep must never crash the whole tick loop — one bad
+ *  leg cannot be allowed to starve its ~15 siblings), but were zero-observability: an operator watching only
+ *  `warn`/`error` would never learn a leg had been silently broken for days. `5` (not `1`) is deliberate —
+ *  a transient blip (one DB reconnect, one timeout) is exactly what fail-open exists to absorb without noise;
+ *  only a STREAK crosses into "diagnosable, not transient". Exported so a future per-leg override is a
+ *  constructor-arg change, not a magic-number hunt. */
+export const REAPER_FAILURE_WARN_THRESHOLD = 5;
+/**
+ * Builds a NAMED, stateful throttle for one reaper leg: attach as `.then(() => guard.onSuccess(), guard.onError)`
+ * in place of a bare `.catch(() => undefined)` (the two-arg `.then` form still catches a rejection from any
+ * earlier link in the chain — same coverage as the `.catch()` it replaces — while also observing the FULFILLED
+ * path, which a plain `.catch()` cannot). Behavior this closure owns, unchanged reaper scheduling/cleanup:
+ *  - a successful run resets the consecutive-failure streak to 0 (one hiccup mid-outage doesn't inflate the count);
+ *  - a failure increments the streak; only once the streak reaches `threshold` (default
+ *    {@link REAPER_FAILURE_WARN_THRESHOLD}) does ONE `warn` line fire (reaper name + streak length + the most
+ *    recent error's message) — then the streak resets to 0 so a STILL-broken leg reports again after another
+ *    full `threshold` run, rather than going silent forever after its first report.
+ * One instance must be created ONCE per named leg (outside the tick's `setInterval` callback) so the streak
+ * survives across ticks — a fresh instance per tick would never accumulate past 1.
+ */
+export function createThrottledReaperCatch(name, logger, threshold = REAPER_FAILURE_WARN_THRESHOLD) {
+    let streak = 0;
+    return {
+        onSuccess: () => {
+            streak = 0;
+        },
+        onError: (err) => {
+            streak += 1;
+            if (streak < threshold)
+                return;
+            try {
+                // #157 补痕交叉复审真发现(codex,2026-08-05):`String(err)` on a pathological rejection reason
+                // (a throwing `Symbol.toPrimitive`/`toString`) or a throwing `logger.warn` transport would otherwise
+                // make THIS handler throw — and since onError is wired as a `.then(fulfilled, onError)` REJECTED
+                // branch with no further `.catch` downstream (every reapers.ts call site), that throw becomes a
+                // floating rejected promise (an unhandled rejection under Node's default handling can crash the
+                // process). The ORIGINAL `.catch(() => undefined)` this replaces could never do that — a failure
+                // in the REPORTING of a swallowed leg failure must not be worse than the silence it replaces, so
+                // this whole block is wrapped total/non-throwing.
+                logger.warn("reaper_leg_repeated_failure", {
+                    reaper: name,
+                    consecutiveFailures: streak,
+                    lastError: err instanceof Error ? err.message : String(err),
+                });
+            }
+            catch {
+                // observability must never itself become the outage — see comment above.
+            }
+            finally {
+                streak = 0; // re-open the window — a leg that stays broken reports again every `threshold` failures, not once ever.
+            }
+        },
+    };
+}
 /** 起后台维护 tick,返回定时器 handle(收尾段 clearInterval 用)。 */
 export function startReapers(ctx) {
-    const { config, logger, metrics, localRoot, backend, subRunner, runStore, checkpointStore, rateLimiter, costQuota, toolResultStore, fileSnapshotStore, taskAttachmentStore, imageBakes, worktreeReap, workflowNotifyGate, workflowJournalStore, sqlWorkflowRunStore, workflowNotifyJournal, rosterStore, backgroundAgentStore, mailboxStore, getRunDenySweep, } = ctx;
+    const { config, logger, metrics, localRoot, backend, subRunner, runStore, checkpointStore, rateLimiter, costQuota, toolResultStore, fileSnapshotStore, taskAttachmentStore, imageBakes, worktreeReap, workflowNotifyGate, workflowJournalStore, sqlWorkflowRunStore, workflowNotifyJournal, rosterStore, backgroundAgentStore, mailboxStore, toolApproval, getRunDenySweep, } = ctx;
     // S7 (SILENT-FALLBACK P0-d): the sweeps' return counts were discarded — an instance death that batch-fails
     // N orphans was indistinguishable from organic failures. Count + log ONLY when a sweep flipped rows (>0),
     // so healthy ticks stay silent. Tolerant of void-returning stores (typeof guard).
@@ -31,6 +88,54 @@ export function startReapers(ctx) {
     let attachmentSweepInFlight = false; // 复审 F1:附件孤儿 sweep 的重入守卫(同上)
     let bgAgentReapInFlight = false; // core 1.364: same serialization for the durable bg-agent joint reap (per-scope serial loop)
     let worktreeReapInFlight = false; // A10 留档发现①(2026-07-29):worktreeReap 重入守卫(同上三个邻居——见下方调用点注释)
+    // #157 / [2762]§五 Z 类补痕:one NAMED throttled-catch guard per periodic leg below (created ONCE here, not
+    // per-tick, so each leg's consecutive-failure streak survives across ticks — see createThrottledReaperCatch).
+    const probeClockSkewGuard = createThrottledReaperCatch("probe_clock_skew", logger);
+    const runsReapStaleGuard = createThrottledReaperCatch("runs_reap_stale", logger);
+    const checkpointsReapExpiredGuard = createThrottledReaperCatch("checkpoints_reap_expired", logger);
+    const runsFailSuspendedExpiredCheckpointGuard = createThrottledReaperCatch("runs_fail_suspended_expired_checkpoint", logger);
+    const runDenySweepGuard = createThrottledReaperCatch("run_deny_sweep", logger);
+    const runsReapSuspendedGuard = createThrottledReaperCatch("runs_reap_suspended", logger);
+    const checkpointReapCtxGuard = createThrottledReaperCatch("checkpoint_reap_ctx", logger);
+    const toolResultReapOlderThanGuard = createThrottledReaperCatch("tool_result_reap_older_than", logger);
+    const fileSnapshotSweepOrphanBlobsGuard = createThrottledReaperCatch("file_snapshot_sweep_orphan_blobs", logger);
+    const attachmentReapUnboundGuard = createThrottledReaperCatch("attachment_reap_unbound", logger);
+    const sessionSweepStagingGuard = createThrottledReaperCatch("session_sweep_staging", logger);
+    const imageBakesReapStaleGuard = createThrottledReaperCatch("image_bakes_reap_stale", logger);
+    const worktreeReapGuard = createThrottledReaperCatch("worktree_reap", logger);
+    const workflowNotifyRecoverGuard = createThrottledReaperCatch("workflow_notify_recover", logger);
+    const workflowJournalReapExpiredGuard = createThrottledReaperCatch("workflow_journal_reap_expired", logger);
+    const workflowRunReapAllScopesGuard = createThrottledReaperCatch("workflow_run_reap_all_scopes", logger);
+    const workflowNotifyJournalReapAckedGuard = createThrottledReaperCatch("workflow_notify_journal_reap_acked", logger);
+    const bgAgentsReapGuard = createThrottledReaperCatch("bg_agents_reap", logger);
+    const rosterReapOlderThanGuard = createThrottledReaperCatch("roster_reap_older_than", logger);
+    const scratchpadSweepStaleGuard = createThrottledReaperCatch("scratchpad_sweep_stale", logger);
+    const approvalReconcileGuard = createThrottledReaperCatch("approval_reconcile", logger);
+    let approvalReconcileInFlight = false; // 车5 §8 C-8:重入守卫(邻居四先例同形——本腿时长随 PARKING 行数增长)
+    // #151 车5(design/172 §3.0 对账收敛器 + 崩溃恢复扫描):**总开关默认 OFF ⇒ 本腿根本不注册**
+    // (`STREAM_APPROVAL_ENABLED=false` 的部署一行库都不扫,零新增查询)。开且有 durable backend 时才建。
+    // 判据 1/2 的两个读口按能力面接:checkpoint 店的窄读口只有 SQL twins 有(local 车道的店没有这个面),
+    // 缺席 ⇒ 判据 1 恒不命中(诚实降级,行落 ②③④⑤),不是「假装没 checkpoint 就该 DENY」。
+    const approvalReconciler = (() => {
+        if (!config.streamApproval.enabled || !backend)
+            return undefined;
+        // duck probe(邻居同形:本文件 `sweepStagingSessions` / `reapAllScopes` 都是这个姿势)——
+        // `CheckpointStoreFull` 的 local 成员没有这个窄读口,它是 SQL twins 的扩展面。
+        const cpPort = checkpointStore;
+        return createApprovalReconciler({
+            askStore: backend.approvalAsk(),
+            checkpoints: typeof cpPort?.findCheckpointCandidatesForAsk === "function" ? cpPort : undefined,
+            // RunStore 三形(TiDB/Pg/File)都带 `getRun`,故直接接、无 probe。
+            runs: runStore,
+            logger,
+            metrics,
+            batchLimit: config.streamApproval.reconcileBatch,
+            pendingGraceMs: config.streamApproval.pendingGraceMs,
+            adhocGraceMs: config.streamApproval.adhocGraceMs,
+            orphanTtlMs: config.streamApproval.orphanTtlMs,
+            ...(toolApproval ? { emitRevoke: (frame, target) => void toolApproval.emitRevoke(frame, target) } : {}),
+        });
+    })();
     // core 1.364([1503] 提货单③):retention **只走** reapDurableAgents(联合 reap:条件删赢了才 release
     // 转录 session;裸 store.reap 会 strand 转录)。staleRunning 翻转在 core 编排内先行(store.reap 一步)。
     // scope 枚举:core 1.368 `BackgroundAgentStore.listScopes?()`([1516]② 交付,SQL twins/File 双实现
@@ -87,7 +192,17 @@ export function startReapers(ctx) {
                 }
                 catch (err) {
                     failedScopes++;
-                    logger.warn("bg_agent_reap_scope_failed", { scope, err: err instanceof Error ? err.message : String(err) });
+                    // codex 交叉复审第三轮真发现(2026-08-05):a poison `err` (throwing `Symbol.toPrimitive`/`toString`)
+                    // or a throwing `logger.warn` must not escape THIS catch — the outer `bgAgentsReapGuard` (this
+                    // car's own wiring) already stops it from becoming an unhandled rejection, but an uncaught throw
+                    // HERE would abort the `for` loop early and skip every remaining scope, defeating the per-scope
+                    // isolation this block exists for ("[1522] LOW3" above — one bad scope must not starve the rest).
+                    try {
+                        logger.warn("bg_agent_reap_scope_failed", { scope, err: err instanceof Error ? err.message : String(err) });
+                    }
+                    catch {
+                        // observability must never break the per-scope loop — see comment above.
+                    }
                 }
             }
             if (failedScopes > 0)
@@ -116,8 +231,11 @@ export function startReapers(ctx) {
         }
     };
     const reaper = setInterval(() => {
-        void probeClockSkew().catch(() => undefined); // S10
-        void runStore?.reapStale(config.runStaleSec * 1000).then(reapCount("runs_reaped_total", { kind: "stale" })).catch(() => undefined);
+        void probeClockSkew().then(() => probeClockSkewGuard.onSuccess(), probeClockSkewGuard.onError); // S10
+        void runStore
+            ?.reapStale(config.runStaleSec * 1000)
+            .then(reapCount("runs_reaped_total", { kind: "stale" }))
+            .then(() => runsReapStaleGuard.onSuccess(), runsReapStaleGuard.onError);
         // Durable F4 (design/45) + design/80 §3 inv#3 crash-safe backstop: CAS-expire checkpoints past their
         // deadline OR their absolute terminal_at backstop (≈ deny), then fail the suspended run rows whose
         // checkpoint was thereby expired (release task_active = unlock the session). These run EVERY tick,
@@ -131,32 +249,51 @@ export function startReapers(ctx) {
             // 真 pin 只存在于 in-memory TtlSessionStore;本部署 durable checkpoint 恒配 durable session 后端
             // (pin=no-op),deny-sweep 走 resumeCheckpoint=core 内部 unpin ✓。SESSION_BACKEND=memory+durable
             // checkpoint 的 niche dev 组合下 abort-expire 臂会把被钉会话泄到进程终——显式接受,不为 dev 形加腿。
-            void checkpointStore.reapExpired(Date.now()).then(reapCount("checkpoints_reaped_total", {})).catch(() => undefined);
-            void runStore?.failSuspendedWithExpiredCheckpoint().then(reapCount("runs_reaped_total", { kind: "expired_checkpoint" })).catch(() => undefined);
+            void checkpointStore
+                .reapExpired(Date.now())
+                .then(reapCount("checkpoints_reaped_total", {}))
+                .then(() => checkpointsReapExpiredGuard.onSuccess(), checkpointsReapExpiredGuard.onError);
+            void runStore
+                ?.failSuspendedWithExpiredCheckpoint()
+                .then(reapCount("runs_reaped_total", { kind: "expired_checkpoint" }))
+                .then(() => runsFailSuspendedExpiredCheckpointGuard.onSuccess(), runsFailSuspendedExpiredCheckpointGuard.onError);
             // D-D SLA-timer: resolve-DENY human/irreversible_ask gates past their deadline (graceful — the model
             // continues with the denial), vs the abort reapExpired gives the other kinds. Bounded per tick.
-            void getRunDenySweep()?.(Date.now()).catch(() => undefined); // A10 搬运改写:晚绑取值(原 `runDenySweep?.`)
+            void getRunDenySweep()?.(Date.now())
+                .then(() => runDenySweepGuard.onSuccess(), runDenySweepGuard.onError); // A10 搬运改写:晚绑取值(原 `runDenySweep?.`)
         }
         // The finer, OPT-IN time-based suspended-run reaper (APPROVAL_TIMEOUT_SEC). Stays gated — reapSuspended
         // with a 0 TTL would nuke ALL suspended rows (cutoff = now). The absolute backstop above is the safety
         // floor; this is the operator-chosen deadline. ([2354] A-5:F4 轮询店的 expireStale 腿随车道退役。)
         if (config.approvalTimeoutSec > 0) {
-            void runStore?.reapSuspended(config.approvalTimeoutSec * 1000).then(reapCount("runs_reaped_total", { kind: "suspended" })).catch(() => undefined);
+            void runStore
+                ?.reapSuspended(config.approvalTimeoutSec * 1000)
+                .then(reapCount("runs_reaped_total", { kind: "suspended" }))
+                .then(() => runsReapSuspendedGuard.onSuccess(), runsReapSuspendedGuard.onError);
         }
         // GC checkpoint_ctx rows whose checkpoint is gone (bound to the checkpoint lifecycle).
-        void checkpointStore?.reapCtx(Date.now() - config.runStaleSec * 1000).catch(() => undefined);
+        void checkpointStore
+            ?.reapCtx(Date.now() - config.runStaleSec * 1000)
+            .then(() => checkpointReapCtxGuard.onSuccess(), checkpointReapCtxGuard.onError);
         rateLimiter?.sweep();
         if (costQuota instanceof CostQuota)
             costQuota.reap(); // TiDB variant self-reaps in its flush loop
-        void toolResultStore?.reapOlderThan?.(Date.now() - config.toolResultTtlSec * 1000)?.catch(() => undefined); // optional extra: SQL twins only (the local FileToolResultStore persists like transcripts)
+        void toolResultStore
+            ?.reapOlderThan?.(Date.now() - config.toolResultTtlSec * 1000)
+            ?.then(() => toolResultReapOlderThanGuard.onSuccess(), toolResultReapOlderThanGuard.onError); // optional extra: SQL twins only (the local FileToolResultStore persists like transcripts)
         // 2c session-sync: GLOBALLY GC grace-window orphan blobs (standalone /sync/blobs PUTs that were never
         // imported are otherwise collected only on reap()/deleteBySession(), which never fire for a never-imported scope).
         // Bounds the standalone-PUT orphan-blob exhaustion (review finding) to the grace window. Durable twins only (local
         // omits the seam → optional-chained no-op).
-        void fileSnapshotStore?.sweepOrphanBlobs?.().catch(() => undefined);
+        void fileSnapshotStore
+            ?.sweepOrphanBlobs?.()
+            .then(() => fileSnapshotSweepOrphanBlobsGuard.onSuccess(), fileSnapshotSweepOrphanBlobsGuard.onError);
         // D-1 附件 TTL:上传后从未被任何 task 引用(session_id NULL)且超过 attachmentUnboundTtlMs 的行收割
         // (绑定行不在此收——随会话 E21 级联删)。best-effort,与其余 reaper 腿同姿。
-        void taskAttachmentStore?.reapUnbound(Date.now() - config.attachmentUnboundTtlMs).then(reapCount("attachments_reaped_total", {})).catch(() => undefined);
+        void taskAttachmentStore
+            ?.reapUnbound(Date.now() - config.attachmentUnboundTtlMs)
+            .then(reapCount("attachments_reaped_total", {}))
+            .then(() => attachmentReapUnboundGuard.onSuccess(), attachmentReapUnboundGuard.onError);
         // D-1 孤儿**对象**彻底 GC(clay 拍 2026-07-28):对象存储 × meta 行对账,grace 默认 1h(上传先行窗
         // 保护;`ATTACHMENT_ORPHAN_GRACE_MS=0` 关掉本腿——同 tick 邻居都有旋钮,复审 F10)。
         // 列举失败=本轮 warn 跳过(「列不出来」绝不当「没有孤儿」),下轮再试。
@@ -171,18 +308,35 @@ export function startReapers(ctx) {
                 metrics.inc("attachment_orphan_objects_swept_total", {}, n);
                 logger.info("attachment_orphan_objects_swept", { removed: n });
             } })
-                .catch((err) => logger.warn("attachment_orphan_sweep_failed", { err: String(err) }))
+                .catch((err) => {
+                // codex 交叉复审第二轮真发现(2026-08-05):`String(err)` on a pathological rejection reason or a
+                // throwing `logger.warn` transport must not escape THIS handler — this `.catch` sits ahead of a
+                // `.finally()` with no further `.catch` downstream, so an uncaught throw here becomes a floating
+                // rejected promise (unhandled rejection under Node's default handling). Same invariant as
+                // createThrottledReaperCatch.onError above: a reaper leg's failure REPORTING must never itself
+                // crash the tick loop.
+                try {
+                    logger.warn("attachment_orphan_sweep_failed", { err: err instanceof Error ? err.message : String(err) });
+                }
+                catch {
+                    // observability must never crash the tick — see comment above.
+                }
+            })
                 .finally(() => { attachmentSweepInFlight = false; });
         }
         // P1d-β 2c session-sync: GC ABANDONED staged imports — staging-id session_event rows (`%#stg-%`) with NO
         // session_meta whose oldest row is older than the grace window (an in-flight stream stays fresh → never reaped).
         // Bounds the orphan-staging-row growth (a Phase B that opened a staging then never committed). Durable session
         // stores only (the local backend stages in memory → no durable rows; the seam is absent → optional-chained no-op).
-        void backend?.session()?.sweepStagingSessions?.().catch(() => undefined);
+        void backend?.session()?.sweepStagingSessions?.()
+            .then(() => sessionSweepStagingGuard.onSuccess(), sessionSweepStagingGuard.onError);
         // Bake-runner backstop (§P2.7): fail any `running` bake whose lease went stale (the runner crashed mid-build),
         // append a synthetic terminal `done{failed}` so SSE readers settle, and force-release the single-flight lease.
         // staleMs (≈3× the 30s heartbeat) bounds a healthy slow build so it is never wrongly reaped.
-        void imageBakes?.reapStaleBakes(config.imageBakes.staleMs).then(reapCount("bakes_reaped_total", {})).catch(() => undefined);
+        void imageBakes
+            ?.reapStaleBakes(config.imageBakes.staleMs)
+            .then(reapCount("bakes_reaped_total", {}))
+            .then(() => imageBakesReapStaleGuard.onSuccess(), imageBakesReapStaleGuard.onError);
         // SVC-3 worktree isolation: deregister worktrees orphaned by a process crash (the Runner never reached
         // destroy → `git worktree remove` never ran). `git worktree prune` cleans registrations whose dirs are
         // already gone. Best-effort, userland (core ships no post-kill Runner hook); never throws. Unset = no-op.
@@ -192,16 +346,22 @@ export function startReapers(ctx) {
         // 照抄 bgAgentReap 的 in-flight + finally 释放形。
         if (worktreeReap && !worktreeReapInFlight) {
             worktreeReapInFlight = true;
-            void worktreeReap().catch(() => undefined).finally(() => (worktreeReapInFlight = false));
+            void worktreeReap()
+                .then(() => worktreeReapGuard.onSuccess(), worktreeReapGuard.onError)
+                .finally(() => (worktreeReapInFlight = false));
         }
         // SVC-1 (adversarial-review HIGH): PERIODIC notify-recovery sweep (not just at boot) — re-delivers a terminal
         // run whose in-process notify was lost, AND finalizes-as-abandoned a `running` run orphaned past the grace
         // window (core never resumes/reaps a prior `running` row, so nothing else would). Idempotent; best-effort.
-        void workflowNotifyGate?.recover({ orphanGraceMs: config.workflowOrphanGraceMs }).catch(() => undefined);
+        void workflowNotifyGate
+            ?.recover({ orphanGraceMs: config.workflowOrphanGraceMs })
+            .then(() => workflowNotifyRecoverGuard.onSuccess(), workflowNotifyRecoverGuard.onError);
         // SVC-2 (adversarial-review HIGH): time-based GC of the workflow_journal table (the heaviest, TaskResult-bearing
         // one) — the per-run deleteByRun has no run-store reap hook, so this bounded sweep is what stops unbounded
         // growth. A resume of a journal older than the retention window re-runs live (resume is an optimization).
-        void workflowJournalStore?.reapExpired?.(Date.now(), config.workflowJournalRetentionMs).catch(() => undefined);
+        void workflowJournalStore
+            ?.reapExpired?.(Date.now(), config.workflowJournalRetentionMs)
+            .then(() => workflowJournalReapExpiredGuard.onSuccess(), workflowJournalReapExpiredGuard.onError);
         // Retention (WorkflowRunStore never auto-purges, reap is explicit):
         // age out TERMINAL workflow_run rows across ALL scopes. SQL twins only (reapAllScopes is their DISTINCT-scope
         // extension; the contract itself has no cross-scope enumeration, and the File store keeps the transcripts-like
@@ -212,37 +372,52 @@ export function startReapers(ctx) {
             const sweep = sqlWorkflowRunStore?.reapAllScopes?.(Date.now(), { maxAgeMs: config.workflowRunRetentionMs });
             if (sweep) {
                 wfRunReapInFlight = true;
-                void sweep.catch(() => undefined).finally(() => (wfRunReapInFlight = false));
+                void sweep
+                    .then(() => workflowRunReapAllScopesGuard.onSuccess(), workflowRunReapAllScopesGuard.onError)
+                    .finally(() => (wfRunReapInFlight = false));
             }
             // 1.108: SQL notify-journal retention rides the same knob — ACKED rows are pure history (pending rows are
             // the recovery backlog and are NEVER reaped; the orphan-grace sweep retires a stuck pending run).
             void workflowNotifyJournal
                 ?.reapAcked?.(Date.now() - config.workflowRunRetentionMs)
-                .catch(() => undefined);
+                .then(() => workflowNotifyJournalReapAckedGuard.onSuccess(), workflowNotifyJournalReapAckedGuard.onError);
         }
         // core 1.364 durable bg-agent joint reap(定义在 interval 上方,契约注释在彼)。in-flight 守卫同
         // wfRun sweep(per-scope 串行循环,短 tick + 多 scope 下不叠罗汉)。
         if (reapBgAgents && !bgAgentReapInFlight) {
             bgAgentReapInFlight = true;
-            void reapBgAgents().catch(() => undefined).finally(() => (bgAgentReapInFlight = false));
+            void reapBgAgents()
+                .then(() => bgAgentsReapGuard.onSuccess(), bgAgentsReapGuard.onError)
+                .finally(() => (bgAgentReapInFlight = false));
         }
         // [1522] MED2:agent_roster TTL 清理(core RB-23②③ 派给部署的半场)——SQL twins 扩展面
         // (reapOlderThan,duck probe;File/Memory 店 core 自带 maxAgeMs,无此面=no-op)。
         void rosterStore
             ?.reapOlderThan?.(Date.now() - config.rosterRetentionMs)
             .then(reapCount("roster_rows_reaped_total", {}))
-            .catch(() => undefined);
+            .then(() => rosterReapOlderThanGuard.onSuccess(), rosterReapOlderThanGuard.onError);
         // 修8(三路复审 absorb-2,接线 (b)):periodic scratchpad sweep — 无 E21 purge 兜到的孤儿目录(session 从未
         // DELETE、purge 当次失败、local 后端无 purge coordinator)按 mtime 过期回收。SCRATCHPAD_SWEEP_TTL_MS
         // (default 7d,0=禁用)。activeSessionIds 不传:活跃判据的诚实边界在 env-facts.ts 的 sweep 文档——TTL 7d
         // 远大于任何在飞任务;一个 7 天零写入的 scratchpad 被回收是可接受的(它本就是临时区,fact 文案即如此宣示)。
+        // #151 车5:流内审批的对账收敛器 + 崩溃恢复扫描(两段都在 `runOnce` 内,见 approval-reconciler.ts
+        // 判据表 v2)。**不新起独立定时器**——复用本 tick(收敛延迟上界 = 一个 reaper tick;壳侧的体感由
+        // 车4 的 425 `Retry-After` 覆盖)。in-flight 守卫同邻居四腿:本腿时长随 PARKING 行数与两个读口的
+        // 库延迟增长,短 REAP_INTERVAL_SEC 下无守卫会逐 tick 叠罗汉压同一批行。
+        if (approvalReconciler && !approvalReconcileInFlight) {
+            approvalReconcileInFlight = true;
+            void approvalReconciler
+                .runOnce(Date.now())
+                .then(() => approvalReconcileGuard.onSuccess(), approvalReconcileGuard.onError)
+                .finally(() => (approvalReconcileInFlight = false));
+        }
         if (config.scratchpadSweepTtlMs > 0) {
             void sweepStaleScratchpads(config.localDataRoot ?? localRoot, { olderThanMs: config.scratchpadSweepTtlMs })
                 .then((removed) => {
                 if (removed > 0)
                     logger.info("scratchpads_swept", { removed });
             })
-                .catch(() => undefined);
+                .then(() => scratchpadSweepStaleGuard.onSuccess(), scratchpadSweepStaleGuard.onError);
         }
     }, config.reapIntervalSec * 1000);
     reaper.unref?.();

package/dist/boot/resolve-spec.d.ts

@@ -1,4 +1,4 @@
-import { type MemoryBackend, type RunnerDeps } from "@sema-agent/core";
+import { type MemoryBackend, type RunnerDeps, type ToolPolicy } from "@sema-agent/core";
 import type { PromptsDomainFaces } from "../prompts-domain-validate.js";
 import { SessionEnvironmentSelection, selectEnvironmentTool } from "../capabilities/select-environment-tool.js";
 import { sendUserFileTool } from "../capabilities/send-user-file-tool.js";
@@ -69,6 +69,21 @@ export interface ResolveSpecCtx {
     perTaskImage: PerTaskImageRegistry;
     sessionEnvSelection: SessionEnvironmentSelection;
 }
+/** #152([2703] 案二):durable 部署上的 AskUserQuestion 门。活体面(QuestionCoordinator)缺席 ⇒ 原形
+ *  `createDurableQuestionPolicy()`(恒 ask ⇒ 恒 durable park)。在场 ⇒ **判决时**按活流上下文分腿:
+ *  活流腿(bg/SSE,coordinator.runWithContext 包裹且投递面此刻可达,ALS 判)allow——工具执行落到
+ *  RunnerDeps.onQuestion 的 coordinator,问正在 tail 流的活人;无活流腿(sync /v1/tasks、verify/cascade、
+ *  durable resume 驱动、断连后的 detach 腿)ask——durable park 原语义逐字保留(此时执行只会拿到 headless
+ *  空答,park 才是把问题送到人面前的那条腿)。
+ *  工具名字面量与 server.ts 的 pre-CAS 守卫同源("AskUserQuestion",core 未根导出常量)。
+ *  ⚠️ **单一属主**(复审 A2):AskUserQuestion 的 durable 判决只有这一处。任何需要「同参重建」这条判决的
+ *  地方(main.ts 的 parkedReviveInheritedGate 父约束链)必须调本工厂,不得自折 core 原形——两份拷贝里
+ *  只改一份正是本条 finding 的成因。**登记豁免一处**:leader worker 腿(src/leader/wire.ts provisionWorker)
+ *  自折 core 原形——该腿无活体问答面可装且 leader 不 import boot 层(分层),core 原形+sentinel 即其完整
+ *  语义;豁免注在彼处互指,接活体面之日必须并回本工厂。 */
+export declare function createDurableQuestionGate(live: {
+    hasLiveContext(): boolean;
+} | undefined): ToolPolicy;
 export declare function createResolveSpec(ctx: ResolveSpecCtx): ServiceDeps["resolveSpec"];
 export {};
 //# sourceMappingURL=resolve-spec.d.ts.map