@sema-agent/server 7.101.0 → 7.101.1

package/dist/boot/stage-10-http-server.js

@@ -186,6 +186,8 @@ export async function runStage10(ctx) {
         isLiveOnThisReplica: server.isRunLiveOnThisReplica,
         ...(runStore ? { runs: runStore } : {}),
         ...(workflowRunStore ? { workflows: workflowRunStore } : {}),
+        agents: backgroundAgentStore,
+        hasPendingAsk: toolApproval ? (originTaskId) => toolApproval.hasLivePendingFrom(originTaskId) : undefined,
         instanceId,
         logger,
         metrics,

package/dist/fleet/fleet-bus.d.ts

@@ -248,13 +248,19 @@ export type FleetFrame = {
      * durable 行压根不存在 —— 三形共同点是**没有终局可投影**,而本副本的行必然陈旧。此时造一个终态
      * 就是编:判死的属主始终是 durable 侧的 reaper。所以只陈述「这条行离场了」,不逼消费端结算。
      * (cli 侧裁量 [ref]:渲「离场」**不清行** —— 行保留、中性离场形、active 扣除、折叠排后。)
+     * 🔴 S-751:子代行的陈述级退场之前,对账腿先问过它的属主(bg registry 非终态 ∨ 有待决审批 ⇒ 留行);
+     * 本帧因此只在「静默满一周期 ∧ 属主不作保」时出现。而它**不封被退那一代**(见 {@link cycleSeq})——
+     * 之后同一代(或更大代)的帧到达 = 那一行其实还活着,行**复活**;更小的代照旧是前代迟到帧。
      * ADDITIVE / tolerate-absent。
      */
     removeReason?: "orphaned";
     /** [ref] §2 判死×判代合成规则:退场帧带**被退那一代**的 {@link FleetTaskRow.cycleSeq}。
      *  消费端因此能把 `retire(gen=N)` 之后的 `frame(gen=N+1)` 读成**复活**(行重生,退休不粘住新代),
-     *  而 `retire(gen=N)` 之后的 `frame(gen=N)` 读成**前代迟到帧,忽略**。缺席同 {@link FleetTaskRow.cycleSeq}
-     *  ——「无此概念」,不是「第一代」。 */
+     *  而**结算级** `retire(gen=N)`(本帧无 `removeReason`)之后的 `frame(gen=N)` 读成**前代迟到帧,忽略**。
+     *  🔴 S-751:**陈述级**退场(`removeReason:"orphaned"`)之后的 `frame(gen=N)` = **复活**,不是迟到帧 ——
+     *  陈述级退场从不断言「这一代结束了」(它说的只是「本副本一个周期没听到这一行」),所以同代的下一帧
+     *  就是它还活着的证据(本仓 {@link FleetEventBus.removeTask} 对这一形不封代,消费端同读);更小的代照旧忽略。
+     *  缺席同 {@link FleetTaskRow.cycleSeq} ——「无此概念」,不是「第一代」。 */
     cycleSeq?: number;
 } | {
     type: "workflow";
@@ -452,7 +458,10 @@ export declare class FleetEventBus {
     private readonly tasks;
     private readonly workflows;
     /** [ref] / codex R1-F2:**代际墓碑** —— 已离场行的最后已知 `cycleSeq`(行本身已从 `tasks` 删掉,
-     *  代际状态却必须活得比行久一点,否则前代迟到帧会在空 Map 上把幽灵行重铸出来)。有界 LRU。 */
+     *  代际状态却必须活得比行久一点,否则前代迟到帧会在空 Map 上把幽灵行重铸出来)。有界 LRU。
+     *  🔴 S-751:碑上多记一位 `ended` = 「**这一代结束了**」是否被断言过。离场**恒**保住代际状态(`gen` 之前的帧
+     *  永远是前代迟到帧 —— 与行还在 Map 里时那道闸同一个判据);只有作「这一代结束了」断言的离场(结算级 / 投影级
+     *  常规清场)才把 `gen` **这一代本身**也封掉。陈述级退场(`removeReason:"orphaned"`)不作这个断言 ⇒ 同代帧 = 复活。 */
     private readonly retiredGen;
     private static readonly RETIRED_GEN_MAX;
     constructor(now?: () => number);
@@ -472,7 +481,7 @@ export declare class FleetEventBus {
     /** Drop a task row (terminal + swept) + fan out the removal. Idempotent (a no-op if already gone).
      *
      *  `opts`([ref],两键均 ADDITIVE):`removeReason:"orphaned"` = **陈述级退场**(没有结算语义,见
-     *  {@link FleetFrame} 的 `task_remove` 臂);`cycleSeq` = 被退那一代的代际号。发布方的常规清场
+     *  {@link FleetFrame} 的 `task_remove` 臂;S-751 起**不封被退那一代**,同代帧 = 复活);`cycleSeq` = 被退那一代的代际号。发布方的常规清场
      *  (`onTerminal`/`onChildTerminal`)不传 opts ⇒ 帧逐字节与本改动之前相同。 */
     removeTask(id: string, opts?: {
         removeReason?: "orphaned";
@@ -489,6 +498,23 @@ export declare class FleetEventBus {
     backgroundChildLaneRow(scope: string | undefined, childUuid: string): string | undefined;
     /** [ref] 让位迁移料的读面:迁移「只补缺席位」需要看得见存活行现有什么(BCE 是权威车道,不覆盖)。 */
     taskRow(id: string): Readonly<FleetTaskRow> | undefined;
+    /**
+     * S-751:一条子代行在它两只**属主账**上的键。三个 id 域互不相同,换算只有本类做得了(两种行 id 都是本文件
+     * 铸的,两域之间唯一的 join —— 让位登记簿 —— 也住在这里),所以换算只写这一处:
+     *  · 行 id —— BCE 车道 = registry handle 本身(`e.taskId`);run-leg 车道 = `${runId} ${子代 task_progress taskId}`
+     *    (`fleetRunPublisher` 的 `childId`);
+     *  · `handle` —— core bg registry / `BackgroundAgentStore` 的行键,**只认** `DURABLE_AGENT_HANDLE_RE` 形
+     *    (`wa*` 不在 bg 账上);
+     *  · `sessionIds` —— 子代自己的 core session id(uuid 域)= 待决审批 `originTaskId` 的值域
+     *    (core `AskRequest.sourceTaskId`:「the issuing task's session id」),**不是** handle。是**集合**:同一行名下
+     *    可以先后挂过几个子代 session(`wa*` 重试换 session、复活换 session),让位登记簿对每一个都留着 claim ——
+     *    只取其一(此前取最早那个)会漏掉当前这一次的卡(codex r1 F3)。
+     * 换不出的键就缺席 / 空(不猜):父链接行 / 顶层 run 行两者皆无;BCE 行在本车道学到子代 uuid 之前 `sessionIds` 为空。
+     */
+    childOwnerKeys(row: Pick<FleetTaskRow, "id" | "scope">): {
+        handle?: string;
+        sessionIds: readonly string[];
+    };
     /** Upsert a workflow row (MERGE by `id`) + fan out. */
     publishWorkflow(delta: Partial<FleetWorkflowRow> & {
         id: string;

package/dist/fleet/fleet-bus.js

@@ -1,5 +1,5 @@
 import { EventEmitter } from "node:events";
-import { deriveAgentDisplayStatus, isDelegatedAgentTerminal } from "@sema-agent/core";
+import { DURABLE_AGENT_HANDLE_RE, deriveAgentDisplayStatus, isDelegatedAgentTerminal } from "@sema-agent/core";
 import { persistedPlaneOf } from "../terminal.js";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { redactSecrets } from "../trace/redact.js";
@@ -74,7 +74,7 @@ export class FleetEventBus {
             return;
         if (existing === undefined && delta.retiredBy === undefined) {
             const tomb = this.retiredGen.get(delta.id);
-            if (tomb !== undefined && delta.cycleSeq !== undefined && delta.cycleSeq <= tomb)
+            if (tomb !== undefined && delta.cycleSeq !== undefined && (delta.cycleSeq < tomb.gen || (tomb.ended && delta.cycleSeq === tomb.gen)))
                 return;
         }
         const merged = { ...(existing ?? { id: delta.id, status: "running" }), ...delta };
@@ -97,10 +97,12 @@ export class FleetEventBus {
         if (existing !== undefined && opts?.cycleSeq !== undefined && existing.cycleSeq !== undefined && existing.cycleSeq > opts.cycleSeq)
             return;
         if (this.tasks.delete(id)) {
-            const gen = existing?.cycleSeq ?? opts?.cycleSeq;
+            const prior = this.retiredGen.get(id);
+            const gen = existing?.cycleSeq ?? opts?.cycleSeq ?? prior?.gen;
             if (gen !== undefined) {
+                const ended = opts?.removeReason !== "orphaned" || (prior !== undefined && prior.gen === gen && prior.ended);
                 this.retiredGen.delete(id);
-                this.retiredGen.set(id, gen);
+                this.retiredGen.set(id, { gen, ended });
                 if (this.retiredGen.size > FleetEventBus.RETIRED_GEN_MAX) {
                     const oldest = this.retiredGen.keys().next();
                     if (!oldest.done)
@@ -138,6 +140,20 @@ export class FleetEventBus {
     taskRow(id) {
         return this.tasks.get(id);
     }
+    childOwnerKeys(row) {
+        const sp = row.id.lastIndexOf(" ");
+        if (sp > 0) {
+            const sessionId = row.id.slice(sp + 1);
+            const claimed = this.bceClaims.get(FleetEventBus.bceKey(row.scope, sessionId));
+            return { sessionIds: [sessionId], ...(claimed !== undefined && DURABLE_AGENT_HANDLE_RE.test(claimed) ? { handle: claimed } : {}) };
+        }
+        const prefix = FleetEventBus.bceKey(row.scope, "");
+        const sessionIds = [];
+        for (const [k, rowId] of this.bceClaims)
+            if (rowId === row.id && k.startsWith(prefix))
+                sessionIds.push(k.slice(prefix.length));
+        return { sessionIds, ...(DURABLE_AGENT_HANDLE_RE.test(row.id) ? { handle: row.id } : {}) };
+    }
     publishWorkflow(delta) {
         const merged = { ...(this.workflows.get(delta.id) ?? { id: delta.id, status: "running" }), ...delta };
         this.workflows.set(delta.id, merged);

package/dist/fleet/fleet-reconciler.d.ts

@@ -33,10 +33,17 @@
  * 「**静默满一个对账周期**」(本腿订阅总线自记每行的最后帧时刻):还在出帧 = 活着的证据。
  * durable 行**在场**的那三格没有这个歧义(`getRun` 命中 = 它就是一条 run 行),故照矩阵即时处置。
  *
- * ## 子代行(§1)
- * 随父:父行退休/退场时**同扫**(与 `onTerminal` 的 removal 集同姿势)。子代**不读 durable** ——
- * bg 子代的 durable 真源在 core 侧 registry,server 不越界重判。无父可循的孤儿子行(父行已不在 bus)
- * 按「bus 内滞留超一个对账周期且无新帧」陈述级退场。
+ * ## 子代行(§1;🔴 S-751 起改为「活性由属主说了算」)
+ * 子代行**不读 durable run 店**(它不是 run 行)。它的活性属主有两只,都在本仓可读 —— 读它们**不是**越界重判,
+ * 是问属主(S-751 之前此处写「bg 子代的 durable 真源在 core 侧 registry,server 不越界重判」,于是判据里只剩
+ * 「静默」这一条,而 registry 的读半场 `RunnerDeps.backgroundAgentStore` 一直就在本仓):
+ *  ① core bg registry(`BackgroundAgentStore` 行 `status` 非终态 = `running` / `parked`);
+ *  ② 本副本审批面的待决卡(子代发起、没人答的 ask —— 子代卡在那儿,当然不出帧)。
+ * **一条规则**:无父可循(父从未在 / 父本周期刚退休或退场)∧ 静默满一个对账周期 ∧ 两只属主都不作保 ⇒
+ * 陈述级退场。父离场**不再无条件同扫**子代(那是报案的一半病:父轮结束、子代一次工具调用 ≥60s 或审批卡
+ * 60s 没人答 ⇒ 活子代被扫);父离场只让子代「无父可循」,子代与既有孤儿走**同一只**判据、同一个循环。
+ * 同一问也挂在「durable 无行」那一格上:父链接未解析的 `a*` 行与顶层行同形(见上方收窄段),run 账不认识它
+ * ≠ 它死了。另一半病(陈述级退场立了代际墓碑、吞掉活子代之后的同代帧)的修在 `fleet-bus.ts` `removeTask`。
  *
  * ## workflow 行(§1)
  * 只做同款「durable 终局投影」([ref] 的 snapshot pull 腿 + reapers 的 workflow recover 腿已在场),
@@ -77,7 +84,7 @@
  * 与 `fleet-terminal-window.ts` 同一论证:两侧边界都由语义定死(比周期短 = 幽灵行仍在面板上,比周期长 =
  * 拿对账腿当历史列表),旋钮只会让部署方去调一个没有正确取值的数;fleet 面现有零旋钮,从之。
  */
-import { type WorkflowRun, type WorkflowRunStore } from "@sema-agent/core";
+import { type BackgroundAgentRecord, type WorkflowRun, type WorkflowRunStore } from "@sema-agent/core";
 import type { Logger } from "../observability/logger.js";
 import type { Metrics } from "../observability/metrics.js";
 import { type RunRecord } from "../plugins/store-contracts.js";
@@ -111,6 +118,12 @@ export interface FleetReconcileRunPort {
 export interface FleetReconcileWorkflowPort {
     get(id: string): Promise<WorkflowRun | null | undefined>;
 }
+/** S-751:core bg registry 账(`BackgroundAgentStore`)的只读窄口 —— 与 {@link FleetReconcileRunPort} 同一条
+ *  单写者纪律(接口上没有写方法)。生产 = `RunnerDeps.backgroundAgentStore` **同实例**(结构上就是它的 `get`
+ *  一面);`null` = 账上没有这一行。 */
+export interface FleetReconcileAgentPort {
+    get(handle: string, scope: string): Promise<Pick<BackgroundAgentRecord, "status"> | null>;
+}
 export interface FleetReconcilerDeps {
     bus: FleetEventBus;
     /**
@@ -130,6 +143,14 @@ export interface FleetReconcilerDeps {
     subscribeRunTerminal?: (fn: (rec: RunTerminalRecord) => void) => () => void;
     runs?: FleetReconcileRunPort;
     workflows?: FleetReconcileWorkflowPort | WorkflowRunStore;
+    /** S-751:子代活性的属主①(bg registry 账)。缺席 = 没有 bg 店的部署(纯内存 dev),这一问问不了。 */
+    agents?: FleetReconcileAgentPort;
+    /**
+     * S-751:子代活性的属主②:这只子代此刻有没有**待决**审批卡。只问是非(与 {@link isLiveOnThisReplica} 同姿势,
+     * 不搬 Map)。入参是 ask 发起者域(子代自己的 core session id,= 卡上的 `originTaskId`),**不是**行 id ——
+     * 行 id → 该域的换算只在 `FleetEventBus.childOwnerKeys`。生产 = `ToolApprovalCoordinator.hasLivePendingFrom`。
+     */
+    hasPendingAsk?: (originTaskId: string) => boolean;
     /** 本副本 id(与 `RunRecord.instanceId` 同域)。只进日志/读数 —— 两条 `running` 臂的**处置相同**
      *  (都是陈述级退场),分不分得出 claim 属谁不改变行为,故它不是判据。 */
     instanceId?: string;
@@ -150,8 +171,10 @@ export interface FleetReconcileTally {
     retired: number;
     /** 陈述级退场的行数(顶层 + 孤儿子行)。 */
     orphaned: number;
-    /** 随父同扫的子行数。 */
+    /** 父本周期刚离场、自己又判成孤儿而陈述级退场的子行数(S-751 前 = 随父无条件同扫的数)。 */
     childrenSwept: number;
+    /** S-751:静默满一周期、无父可循(或 run 账不认识),但属主作保而**留行**的子行数。 */
+    childrenKeptAlive: number;
     /** durable 终局 ⇒ 投影退休的 workflow 行数。 */
     workflowsRetired: number;
     /** 本周期实际发出的 durable 点读次数。 */

package/dist/fleet/fleet-reconciler.js

@@ -11,7 +11,7 @@ export const FLEET_RECONCILE_COOLDOWN_MS = 60_000;
 export const FLEET_RECONCILE_WATCH_MAX = 200;
 export const FLEET_RECONCILE_WATCH_TTL_MS = 30 * 60_000;
 const emptyTally = () => ({
-    scanned: 0, skippedLive: 0, skippedParked: 0, retired: 0, orphaned: 0, childrenSwept: 0, workflowsRetired: 0, reads: 0, cooling: false, failOpen: false,
+    scanned: 0, skippedLive: 0, skippedParked: 0, retired: 0, orphaned: 0, childrenSwept: 0, childrenKeptAlive: 0, workflowsRetired: 0, reads: 0, cooling: false, failOpen: false,
 });
 function rotate(rows, cursor) {
     if (cursor === undefined || rows.length === 0)
@@ -22,6 +22,22 @@ function rotate(rows, cursor) {
     return [...rows.slice(at), ...rows.slice(0, at)];
 }
 const SILENT_FOR_A_CYCLE = FLEET_RECONCILE_INTERVAL_MS;
+function bgAgentVouches(status) {
+    switch (status) {
+        case "running":
+        case "parked":
+            return true;
+        case "completed":
+        case "failed":
+        case "killed":
+            return false;
+        default: {
+            const unhandled = status;
+            recordFailOpen("server.fleet.agent-status-unmapped", String(unhandled));
+            return true;
+        }
+    }
+}
 export function createFleetReconciler(deps) {
     const now = deps.now ?? (() => Date.now());
     const lastFrameAt = new Map();
@@ -86,11 +102,11 @@ export function createFleetReconciler(deps) {
         coolingUntil = undefined;
         const deadline = now() + FLEET_RECONCILE_READ_BUDGET_MS;
         const budgetLeft = () => tally.reads < FLEET_RECONCILE_MAX_ROWS && now() < deadline;
-        const readRun = async (id) => {
+        const budgetedRead = async (read) => {
             tally.reads++;
             let t;
-            const rec = await Promise.race([
-                deps.runs.getRun(id),
+            return await Promise.race([
+                read(),
                 new Promise((_r, reject) => {
                     t = setTimeout(() => reject(new ReadAborted(`fleet reconcile read exceeded ${FLEET_RECONCILE_READ_BUDGET_MS}ms`)), Math.max(0, deadline - now()));
                     if (typeof t.unref === "function")
@@ -100,30 +116,43 @@ export function createFleetReconciler(deps) {
                 if (t !== undefined)
                     clearTimeout(t);
             });
-            return rec;
         };
+        const readRun = (id) => budgetedRead(() => deps.runs.getRun(id));
         const snap = deps.bus.snapshot();
         for (const r of snap.tasks)
             if (!lastFrameAt.has(r.id))
                 lastFrameAt.set(r.id, nowMs);
         const idle = (id) => nowMs - (lastFrameAt.get(id) ?? nowMs) >= SILENT_FOR_A_CYCLE;
         const present = new Set(snap.tasks.map((r) => r.id));
-        const kids = new Map();
-        for (const r of snap.tasks) {
-            if (r.parentId === undefined)
-                continue;
-            const bucket = kids.get(r.parentId);
-            if (bucket)
-                bucket.push(r);
-            else
-                kids.set(r.parentId, [r]);
-        }
-        const sweepChildren = (parentId) => {
-            for (const c of kids.get(parentId) ?? []) {
-                deps.bus.removeTask(c.id, { removeReason: "orphaned", ...(c.cycleSeq !== undefined ? { cycleSeq: c.cycleSeq } : {}) });
-                lastFrameAt.delete(c.id);
-                tally.childrenSwept++;
+        const parentsOnBus = new Set(present);
+        const stillSilent = (row) => {
+            const cur = deps.bus.taskRow(row.id);
+            return cur !== undefined && cur.cycleSeq === row.cycleSeq && idle(row.id);
+        };
+        const keptAlive = (row, why) => {
+            tally.childrenKeptAlive++;
+            deps.logger?.info("fleet_row_reconciled", { taskId: row.id, disposition: "child_kept_alive", why, instanceId: deps.instanceId ?? null });
+        };
+        const judgeSilentRow = async (row, exit) => {
+            const handle = deps.bus.childOwnerKeys(row).handle;
+            if (handle !== undefined && deps.agents !== undefined && row.scope !== undefined) {
+                if (!budgetLeft())
+                    return "over_budget";
+                const scope = row.scope;
+                const rec = await budgetedRead(() => deps.agents.get(handle, scope));
+                if (rec !== null && bgAgentVouches(rec.status)) {
+                    keptAlive(row, "bg_registry");
+                    return "settled";
+                }
+            }
+            const hasPendingAsk = deps.hasPendingAsk;
+            if (hasPendingAsk !== undefined && deps.bus.childOwnerKeys(row).sessionIds.some((id) => hasPendingAsk(id))) {
+                keptAlive(row, "pending_ask");
+                return "settled";
             }
+            if (stillSilent(row))
+                exit();
+            return "settled";
         };
         const retire = (row, rec) => {
             deps.bus.publishTask({
@@ -132,14 +161,14 @@ export function createFleetReconciler(deps) {
                 retiredBy: "reconcile",
                 ...fleetRunResiduals(rec.result),
             });
-            sweepChildren(row.id);
+            parentsOnBus.delete(row.id);
             deps.bus.removeTask(row.id, { ...(row.cycleSeq !== undefined ? { cycleSeq: row.cycleSeq } : {}) });
             lastFrameAt.delete(row.id);
             tally.retired++;
             deps.metrics?.inc("fleet_rows_reconciled_total", { disposition: "retired" });
         };
         const orphanExit = (row, why) => {
-            sweepChildren(row.id);
+            parentsOnBus.delete(row.id);
             deps.bus.removeTask(row.id, { removeReason: "orphaned", ...(row.cycleSeq !== undefined ? { cycleSeq: row.cycleSeq } : {}) });
             lastFrameAt.delete(row.id);
             if (deps.runs && watch.size < FLEET_RECONCILE_WATCH_MAX)
@@ -148,6 +177,61 @@ export function createFleetReconciler(deps) {
             deps.metrics?.inc("fleet_rows_reconciled_total", { disposition: "orphaned" });
             deps.logger?.info("fleet_row_reconciled", { taskId: row.id, disposition: "orphaned", why, instanceId: deps.instanceId ?? null });
         };
+        const childExit = (row, parentId) => {
+            deps.bus.removeTask(row.id, { removeReason: "orphaned", ...(row.cycleSeq !== undefined ? { cycleSeq: row.cycleSeq } : {}) });
+            lastFrameAt.delete(row.id);
+            parentsOnBus.delete(row.id);
+            if (present.has(parentId)) {
+                tally.childrenSwept++;
+            }
+            else {
+                tally.orphaned++;
+                deps.metrics?.inc("fleet_rows_reconciled_total", { disposition: "orphaned_child" });
+            }
+        };
+        const judgeTopLevel = async (row) => {
+            tally.scanned++;
+            if (deps.isLiveOnThisReplica(row.id)) {
+                tally.skippedLive++;
+                return "settled";
+            }
+            if (!deps.runs)
+                return "settled";
+            if (!budgetLeft())
+                return "over_budget";
+            const rec = await readRun(row.id);
+            if (deps.isLiveOnThisReplica(row.id)) {
+                tally.skippedLive++;
+                return "settled";
+            }
+            const nowRow = deps.bus.taskRow(row.id);
+            if (nowRow === undefined)
+                return "settled";
+            if (nowRow.cycleSeq !== row.cycleSeq)
+                return "settled";
+            if (rec === undefined) {
+                if (!idle(row.id))
+                    return "settled";
+                return judgeSilentRow(row, () => orphanExit(row, "durable_row_absent"));
+            }
+            if (isTerminalRunStatus(rec.status)) {
+                retire(row, rec);
+                return "settled";
+            }
+            if (isParkedRunStatus(rec.status)) {
+                tally.skippedParked++;
+                return "settled";
+            }
+            orphanExit(row, runProvenElsewhere(rec, deps.instanceId) ? "durable_running_other_replica" : "durable_running_no_local_leg");
+            return "settled";
+        };
+        const judgeChild = async (row, parentId) => {
+            if (parentsOnBus.has(parentId))
+                return "settled";
+            if (!idle(row.id))
+                return "settled";
+            return judgeSilentRow(row, () => childExit(row, parentId));
+        };
         try {
             for (const [id, w] of [...watch]) {
                 if (nowMs - w.at > FLEET_RECONCILE_WATCH_TTL_MS) {
@@ -171,53 +255,11 @@ export function createFleetReconciler(deps) {
                     tally.retired++;
             }
             for (const row of rotate(snap.tasks, taskCursor)) {
-                if (row.parentId !== undefined)
-                    continue;
-                tally.scanned++;
-                if (deps.isLiveOnThisReplica(row.id)) {
-                    tally.skippedLive++;
-                    continue;
-                }
-                if (!deps.runs)
-                    continue;
-                if (!budgetLeft()) {
+                const step = row.parentId === undefined ? await judgeTopLevel(row) : await judgeChild(row, row.parentId);
+                if (step === "over_budget") {
                     taskCursor = row.id;
                     break;
                 }
-                const rec = await readRun(row.id);
-                if (deps.isLiveOnThisReplica(row.id)) {
-                    tally.skippedLive++;
-                    continue;
-                }
-                const nowRow = deps.bus.taskRow(row.id);
-                if (nowRow === undefined)
-                    continue;
-                if (nowRow.cycleSeq !== row.cycleSeq)
-                    continue;
-                if (rec === undefined) {
-                    if (idle(row.id))
-                        orphanExit(row, "durable_row_absent");
-                    continue;
-                }
-                if (isTerminalRunStatus(rec.status)) {
-                    retire(row, rec);
-                    continue;
-                }
-                if (isParkedRunStatus(rec.status)) {
-                    tally.skippedParked++;
-                    continue;
-                }
-                orphanExit(row, runProvenElsewhere(rec, deps.instanceId) ? "durable_running_other_replica" : "durable_running_no_local_leg");
-            }
-            for (const row of snap.tasks) {
-                if (row.parentId === undefined || present.has(row.parentId))
-                    continue;
-                if (!idle(row.id))
-                    continue;
-                deps.bus.removeTask(row.id, { removeReason: "orphaned", ...(row.cycleSeq !== undefined ? { cycleSeq: row.cycleSeq } : {}) });
-                lastFrameAt.delete(row.id);
-                tally.orphaned++;
-                deps.metrics?.inc("fleet_rows_reconciled_total", { disposition: "orphaned_child" });
             }
             if (wfGet) {
                 for (const wf of rotate(snap.workflows, wfCursor)) {
@@ -227,19 +269,7 @@ export function createFleetReconciler(deps) {
                         wfCursor = wf.id;
                         break;
                     }
-                    tally.reads++;
-                    let wfTimer;
-                    const run = await Promise.race([
-                        wfGet(wf.id),
-                        new Promise((_r, reject) => {
-                            wfTimer = setTimeout(() => reject(new ReadAborted("fleet reconcile workflow read over budget")), Math.max(0, deadline - now()));
-                            if (typeof wfTimer.unref === "function")
-                                wfTimer.unref();
-                        }),
-                    ]).finally(() => {
-                        if (wfTimer !== undefined)
-                            clearTimeout(wfTimer);
-                    });
+                    const run = await budgetedRead(() => wfGet(wf.id));
                     if (!run || !isTerminalWorkflowStatus(run.status))
                         continue;
                     if (wf.scope !== undefined && run.scope !== wf.scope)

package/dist/observability/fail-open.d.ts

@@ -173,6 +173,10 @@ export declare const FAIL_OPEN_TAGS: {
         readonly cls: "F";
         readonly note: "A-032 P1-④:`runStatusToFleet` 收到**词表外**的 run 状态词(闭集签名之外的唯一来路 = `rowToRun` 把无约束的 status 文本列裸 cast,滚动升级里更新的副本写的新词被旧副本读到)⇒ 折成 `idle`。放行的最坏后果 = 该行在 fleet 面板上**永久滞留**(removal 集 {completed,failed,killed} 收不到 idle),纯展示面、不影响 run 本身与任何执法判据,故 F 类。方向刻意不改(把 miss 折成终局会把一条还在跑的任务从面板上摘掉,误摘比多一行更伤)。留痕是承重的:2026-06-28 on-box e2e 逮到的 `blocked` 泄漏当年只能靠人眼在面板上发现——计数让下一次词表漂移在遥测里当场显形。编译期一侧已由闭集入参 + `never` 臂执法。";
     };
+    readonly "server.fleet.agent-status-unmapped": {
+        readonly cls: "F";
+        readonly note: "S-751:fleet 对账腿问 bg registry「这只子代还活着吗」时,读到**词表外**的 `BackgroundAgentRecord.status`(闭集之外的唯一来路 = SQL 孪生把 status 文本列裸 cast 成联合,滚动升级里更新的 core 写下的新词被本副本读到)⇒ 按「属主作保」处置:子代行**留在面板上**。放行的最坏后果 = 一条其实已终局的子代行多留在面板上(它的终态通知仍会结算它;与 #261 之前「子代行永远不走」同形),纯展示面、不影响子代本身与任何执法判据,故 F 类。方向刻意不折成「死」:把不认识的词读成死会把一只正在跑的后台子代从面板上摘掉,而那正是 S-751 报案的症状(误摘比多一行更伤,与 `server.fleet.run-status-unmapped` 同一条判据)。编译期一侧由 `bgAgentVouches` 的穷举 switch + `never` 臂执法;留痕让词表漂移在遥测里当场显形。";
+    };
     readonly "server.run-store.stale-claim-quarantine-unremoved": {
         readonly cls: "F";
         readonly note: "#213 陈旧 claim 接管:claim 已 rename 进 tmp/ 隔离名(接管本体已完成、正确性不受影响),但隔离件 rmSync 失败留在 tmp。放行的最坏后果 = tmp 里多一个死文件(不在 activeDir,hydrate 永不把它当 claim 复活);故 F 类。必须留痕:反复删不掉 = tmp 权限/fs 病灶,静默吞掉会让 tmp 无声膨胀。";

package/dist/observability/fail-open.js

@@ -164,6 +164,10 @@ export const FAIL_OPEN_TAGS = {
         cls: "F",
         note: "A-032 P1-④:`runStatusToFleet` 收到**词表外**的 run 状态词(闭集签名之外的唯一来路 = `rowToRun` 把无约束的 status 文本列裸 cast,滚动升级里更新的副本写的新词被旧副本读到)⇒ 折成 `idle`。放行的最坏后果 = 该行在 fleet 面板上**永久滞留**(removal 集 {completed,failed,killed} 收不到 idle),纯展示面、不影响 run 本身与任何执法判据,故 F 类。方向刻意不改(把 miss 折成终局会把一条还在跑的任务从面板上摘掉,误摘比多一行更伤)。留痕是承重的:2026-06-28 on-box e2e 逮到的 `blocked` 泄漏当年只能靠人眼在面板上发现——计数让下一次词表漂移在遥测里当场显形。编译期一侧已由闭集入参 + `never` 臂执法。",
     },
+    "server.fleet.agent-status-unmapped": {
+        cls: "F",
+        note: "S-751:fleet 对账腿问 bg registry「这只子代还活着吗」时,读到**词表外**的 `BackgroundAgentRecord.status`(闭集之外的唯一来路 = SQL 孪生把 status 文本列裸 cast 成联合,滚动升级里更新的 core 写下的新词被本副本读到)⇒ 按「属主作保」处置:子代行**留在面板上**。放行的最坏后果 = 一条其实已终局的子代行多留在面板上(它的终态通知仍会结算它;与 #261 之前「子代行永远不走」同形),纯展示面、不影响子代本身与任何执法判据,故 F 类。方向刻意不折成「死」:把不认识的词读成死会把一只正在跑的后台子代从面板上摘掉,而那正是 S-751 报案的症状(误摘比多一行更伤,与 `server.fleet.run-status-unmapped` 同一条判据)。编译期一侧由 `bgAgentVouches` 的穷举 switch + `never` 臂执法;留痕让词表漂移在遥测里当场显形。",
+    },
     "server.run-store.stale-claim-quarantine-unremoved": {
         cls: "F",
         note: "#213 陈旧 claim 接管:claim 已 rename 进 tmp/ 隔离名(接管本体已完成、正确性不受影响),但隔离件 rmSync 失败留在 tmp。放行的最坏后果 = tmp 里多一个死文件(不在 activeDir,hydrate 永不把它当 claim 复活);故 F 类。必须留痕:反复删不掉 = tmp 权限/fs 病灶,静默吞掉会让 tmp 无声膨胀。",

package/dist/tool-approval.d.ts

@@ -1588,6 +1588,15 @@ export declare class ToolApprovalCoordinator {
      *  宁少列不超范围;`"__none__"` 未鉴权哨兵自然恒空)。行的 `approvalId` 就是 `respond()` 收的 id
      *  (同源可达,[ref] 判据);`expiresAtMs` 照抄登记时单点铸定的窗死线([ref] 三键同一个数)。 */
     listLivePending(scope: string | undefined): LivePendingRow[];
+    /**
+     * S-751:某只委派子代此刻有没有**待决**的活卡 —— fleet 对账腿「子代活性由属主说了算」的属主②读口(另一只是
+     * bg registry 账)。子代卡在一张没人答的卡上时当然不出帧,只看「静默」就会把它当孤儿扫下面板(报案的真形)。
+     * 只答是非、不交出 Map(与 `isRunLiveOnThisReplica` 同姿势);纯读,零锁零结算语义。
+     * 键 = ask 发起者域(`originTaskId` = core `AskRequest.sourceTaskId` = 子代自己的 core session id),**不是**
+     * fleet 行 id —— 换算在 `FleetEventBus.childOwnerKeys`。只看本副本的内存登记:子代跑在本副本,它的活卡就登记在
+     * 本副本;耐久 park 的卡由 bg registry 的 `parked` 态作保(见 fleet-reconciler.ts `bgAgentVouches`)。
+     */
+    hasLivePendingFrom(originTaskId: string): boolean;
     /**
      * 🔴 [ref](案A)追记 F4 —— **跨副本决议的执行通知**(悬挂行的一次终态轮询)。
      *

package/dist/tool-approval.js

@@ -2114,6 +2114,12 @@ export class ToolApprovalCoordinator {
         }
         return rows;
     }
+    hasLivePendingFrom(originTaskId) {
+        for (const e of this.pending.values())
+            if (e.originTaskId === originTaskId)
+                return true;
+        return false;
+    }
     async pollSuspendedDecisions() {
         const store = this.askStore;
         if (!store)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.101.0",
+  "version": "7.101.1",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",