@sema-agent/server 7.43.0 → 7.44.0

package/dist/boot/reapers.js

@@ -1,45 +1,10 @@
-/**
- * design/158 A10:composition root 分段 —— 后台 reaper / 维护 tick。
- *
- * 纯搬运:函数体逐字来自 `main.ts`(原 2387-2599 行),缩进不变;新增的只有 import 与
- * `startReapers(ctx)` 包壳。
- *
- * ⚠️ **位置即契约**:
- *  1. 本段必须在 `createHttpServer` **之前**调用 —— D-D SLA-timer 的 deny-sweep 是 server 造出来的,
- *     故经 `getRunDenySweep()` 晚绑(`let runDenySweep` 仍留在 main.ts,赋值点仍在 server 之后)。
- *     这是本次搬运里**唯一**一行改写(`runDenySweep?.(…)` → `getRunDenySweep()?.(…)`)。
- *  2. `reaper.unref?.()` 必须紧跟 `setInterval`(定时器绝不可持住进程),故一并搬进本函数、
- *     返回值只交出 handle 给收尾段 `clearInterval`。
- *  3. tick 内各腿的**相对次序**逐字保留:probeClockSkew(时钟指纹)先于任何按本地时钟分桶的清算。
- */
 import { Runner, defaultTaskRegistry } from "@sema-agent/core";
 import { sweepStaleScratchpads } from "../env-facts.js";
 import { CostQuota } from "../observability/cost-quota.js";
 import { isAdoptionQuiescing, trackMaintenanceLeg } from "../adoption/quiesce.js";
 import { createApprovalReconciler } from "../approval-reconciler.js";
 import { createE2bOrphanSandboxProvider, reclaimOrphanE2bSandboxes, E2B_ORPHAN_GRACE_MS } from "../plugins/e2b-orphan-reclaim.js";
-/** #157 / [2762]§五(sema-comms `audits/failopen-governance-176.md` §7 "Z 类 1 条"):default consecutive-failure
- *  count before a reaper leg's swallowed error gets a `warn` line. The ~15 `.catch(() => undefined)` sites
- *  below are correct in DIRECTION (a hiccuping periodic sweep must never crash the whole tick loop — one bad
- *  leg cannot be allowed to starve its ~15 siblings), but were zero-observability: an operator watching only
- *  `warn`/`error` would never learn a leg had been silently broken for days. `5` (not `1`) is deliberate —
- *  a transient blip (one DB reconnect, one timeout) is exactly what fail-open exists to absorb without noise;
- *  only a STREAK crosses into "diagnosable, not transient". Exported so a future per-leg override is a
- *  constructor-arg change, not a magic-number hunt. */
 export const REAPER_FAILURE_WARN_THRESHOLD = 5;
-/**
- * Builds a NAMED, stateful throttle for one reaper leg: attach as `.then(() => guard.onSuccess(), guard.onError)`
- * in place of a bare `.catch(() => undefined)` (the two-arg `.then` form still catches a rejection from any
- * earlier link in the chain — same coverage as the `.catch()` it replaces — while also observing the FULFILLED
- * path, which a plain `.catch()` cannot). Behavior this closure owns, unchanged reaper scheduling/cleanup:
- *  - a successful run resets the consecutive-failure streak to 0 (one hiccup mid-outage doesn't inflate the count);
- *  - a failure increments the streak; only once the streak reaches `threshold` (default
- *    {@link REAPER_FAILURE_WARN_THRESHOLD}) does ONE `warn` line fire (reaper name + streak length + the most
- *    recent error's message) — then the streak resets to 0 so a STILL-broken leg reports again after another
- *    full `threshold` run, rather than going silent forever after its first report.
- * One instance must be created ONCE per named leg (outside the tick's `setInterval` callback) so the streak
- * survives across ticks — a fresh instance per tick would never accumulate past 1.
- */
 export function createThrottledReaperCatch(name, logger, threshold = REAPER_FAILURE_WARN_THRESHOLD) {
     let streak = 0;
     return {
@@ -51,14 +16,6 @@ export function createThrottledReaperCatch(name, logger, threshold = REAPER_FAIL
             if (streak < threshold)
                 return;
             try {
-                // #157 补痕交叉复审真发现(codex,2026-08-05):`String(err)` on a pathological rejection reason
-                // (a throwing `Symbol.toPrimitive`/`toString`) or a throwing `logger.warn` transport would otherwise
-                // make THIS handler throw — and since onError is wired as a `.then(fulfilled, onError)` REJECTED
-                // branch with no further `.catch` downstream (every reapers.ts call site), that throw becomes a
-                // floating rejected promise (an unhandled rejection under Node's default handling can crash the
-                // process). The ORIGINAL `.catch(() => undefined)` this replaces could never do that — a failure
-                // in the REPORTING of a swallowed leg failure must not be worse than the silence it replaces, so
-                // this whole block is wrapped total/non-throwing.
                 logger.warn("reaper_leg_repeated_failure", {
                     reaper: name,
                     consecutiveFailures: streak,
@@ -66,38 +23,13 @@ export function createThrottledReaperCatch(name, logger, threshold = REAPER_FAIL
                 });
             }
             catch {
-                // observability must never itself become the outage — see comment above.
             }
             finally {
-                streak = 0; // re-open the window — a leg that stays broken reports again every `threshold` failures, not once ever.
+                streak = 0;
             }
         },
     };
 }
-/**
- * 🔴 #292 C18(core 5.48.0 design/323,[4743] 提货单)——**分区腿武装**的判据本体。
- *
- * core 5.48 起 `reapDurableAgents` 的 `deps.sessions` 多一只可选 `listPlaced`:在场即启用**分区收割
- * 腿** —— 一条 placed 转录的属主行已经不在(put 从未落地 / 上一轮条件删赢了但 release 失败)时,行驱动
- * 的那条臂**结构上看不见**它(它从行出发枚举),只有从会话侧枚举才找得到。
- *
- * 两只面必须落在**host durable 店**上,而 release 这一格是承重的:
- *  · `listPlaced` = host 店的分区枚举(SQL 孪生实装;local/File 后端无此面 ⇒ 键**不设**,core 那条腿
- *    如实不可用 —— 绝不给一个恒返回 `[]` 的假面,那会把「枚不了」读成「没有孤儿」);
- *  · `release` 对 **placed id** 必须走 host 店:路由店(`ForkRoutingSessionStore`)对一个重启后不认识
- *    的 id 会回落 transient(进程内 no-op),那会让 core 数出一次**从未发生**的 release
- *    (`orphanPlacedReleased` 当场变成谎)而字节还在库里。故先按**持久化元组**判(一次 PK 探针),
- *    placed 走 host 店的真删除;其余 id 原样保留 [1522] 裁定的双店语义。
- *  · 🔴 探针本身失败 ⇒ **响亮抛**(codex 对抗复审 R1-[medium],验真后修:本函数的初版把探针错误
- *    改写成 `undefined` 再落路由店 —— 而重启后路由店不认识 placed id ⇒ transient no-op,core 却因为
- *    release 正常 resolve 而 `orphanPlacedReleased++`。间歇性 DB 故障于是被**伪装成 GC 成功**:监控
- *    报着「收掉了 N 条孤儿」,durable 字节一条没动。这正是本函数顶注要防的那个形,初版自己踩了。
- *    抛的后果是安全的:core 两条臂的 release 都在 try 内、且计数在 release **之后**递增 ⇒ 抛 = 不计数
- *    + 下一 tick 重新枚举重试(失败经济学与 core 的成文一致:泄漏给下一轮,而不是谎报已清)。
- *
- * 抽成具名工厂而不是就地闭包的理由与 `createEngineNoticeSeat` 逐字同一条:判据在**值**上
- * (哪只店被调),源码文本门看不出对错,只有行为测得出来。
- */
 export function createPlacementAwareReapSessions(deps) {
     const { host, routed } = deps;
     const listPlaced = typeof host?.listPlaced === "function" ? host.listPlaced.bind(host) : undefined;
@@ -111,12 +43,10 @@ export function createPlacementAwareReapSessions(deps) {
                     placed = await placementOf(sessionId);
                 }
                 catch (err) {
-                    // 探针失败 = 「这条 id 是不是 placed」这件事**不知道**。不知道就不许当成「不是」——那会把它
-                    // 送去路由店拿一次 no-op 冒充成功释放(见上方顶注)。响亮抛,计数不涨,下一 tick 重来。
                     throw new Error(`placement probe failed for session ${sessionId} — refusing to release it blindly (a routed no-op would be counted as a real GC): ${err instanceof Error ? err.message : String(err)}`, err instanceof Error ? { cause: err } : undefined);
                 }
                 if (placed !== undefined) {
-                    await host.release(sessionId); // placed ⇒ host 店的 release = 真删除(义务 4)
+                    await host.release(sessionId);
                     return;
                 }
             }
@@ -125,20 +55,8 @@ export function createPlacementAwareReapSessions(deps) {
         ...(listPlaced !== undefined ? { listPlaced } : {}),
     };
 }
-/** 起后台维护 tick,返回定时器 handle(收尾段 clearInterval 用)。 */
 export function startReapers(ctx) {
     const { config, logger, metrics, localRoot, backend, subRunner, runStore, checkpointStore, rateLimiter, costQuota, toolResultStore, fileSnapshotStore, taskAttachmentStore, imageBakes, worktreeReap, workflowNotifyGate, workflowRecoverOpts, workflowJournalStore, sqlWorkflowRunStore, workflowNotifyJournal, rosterStore, backgroundAgentStore, mailboxStore, toolApproval, permissionRuleStores, getRunDenySweep, } = ctx;
-    // S7 (SILENT-FALLBACK P0-d): the sweeps' return counts were discarded — an instance death that batch-fails
-    // N orphans was indistinguishable from organic failures. Count + log ONLY when a sweep flipped rows (>0),
-    // so healthy ticks stay silent. Tolerant of void-returning stores (typeof guard).
-    /**
-     * 一条维护腿的**起飞登记**(codex 对抗复审 R1 [high] 的修复面)。
-     *
-     * 代替裸 `void <promise>`:语义与 `void` 完全一样(不 await、错误由各腿自己的 guard 接住),
-     * 只多一件事 —— 把这一份 promise 登记进收编闸的在飞集,好让一条正要动数据的收编弧**等它落地**。
-     * 少一处没换,那条腿就是闸的漏网者(而漏网是静默的),所以本文件里 tick 内**不该再出现裸 `void`**。
-     * 入参允许 `undefined`(可选链的腿:`void store?.reap()` 在店缺席时求值成 undefined)。
-     */
     const leg = (p) => {
         if (p !== undefined)
             trackMaintenanceLeg(p);
@@ -149,26 +67,18 @@ export function startReapers(ctx) {
             logger.info("reaper_swept", { metric, ...labels, count: n });
         }
     };
-    // #242:E2B 孤儿回收腿的三件座——provider(仅 e2b 部署形 + 旋钮 ON 时铸,一次)、时间节流锚
-    // (初始 -GRACE ⇒ 首 tick 即跑,承担 boot 半场)、重入守卫(list+逐杀可能跨多个 tick;provider RPC
-    // 带 SDK 级 requestTimeoutMs,旗不会因一次挂起永挂)。节流锚刻意用墙钟(codex R3 登记不改):判据
-    // 侧的 GRACE 比对是 E2B startedAt(墙钟)vs Date.now(墙钟)同钟系,节流锚换单调钟只护住「回拨多跑
-    // 一轮 list」这种无害面,却让本文件唯一一处异质钟——不值。锚在**发起时**推进(非成功时):失败轮也
-    // 压满 GRACE 间隔=对 provider 的天然退避;错误可见性由 e2bOrphanGuard 的连败阈值 warn 承担。
     const e2bOrphanProvider = config.remoteExec?.provider === "e2b" && config.remoteExec.orphanReclaim !== false
         ? createE2bOrphanSandboxProvider({ apiKey: config.remoteExec.apiKey })
         : undefined;
     let e2bOrphanLastRunMs = Date.now() - E2B_ORPHAN_GRACE_MS;
     let e2bOrphanInFlight = false;
-    let wfRunReapInFlight = false; // 1.108 review (lens③): serialize the all-scopes retention sweep across ticks
-    let attachmentSweepInFlight = false; // 复审 F1:附件孤儿 sweep 的重入守卫(同上)
-    let bgAgentReapInFlight = false; // core 1.364: same serialization for the durable bg-agent joint reap (per-scope serial loop)
-    let worktreeReapInFlight = false; // A10 留档发现①(2026-07-29):worktreeReap 重入守卫(同上三个邻居——见下方调用点注释)
-    // #157 / [2762]§五 Z 类补痕:one NAMED throttled-catch guard per periodic leg below (created ONCE here, not
-    // per-tick, so each leg's consecutive-failure streak survives across ticks — see createThrottledReaperCatch).
+    let wfRunReapInFlight = false;
+    let attachmentSweepInFlight = false;
+    let bgAgentReapInFlight = false;
+    let worktreeReapInFlight = false;
     const probeClockSkewGuard = createThrottledReaperCatch("probe_clock_skew", logger);
     const runsReapStaleGuard = createThrottledReaperCatch("runs_reap_stale", logger);
-    const e2bOrphanGuard = createThrottledReaperCatch("e2b_orphan_reclaim", logger); // #242
+    const e2bOrphanGuard = createThrottledReaperCatch("e2b_orphan_reclaim", logger);
     const checkpointsReapExpiredGuard = createThrottledReaperCatch("checkpoints_reap_expired", logger);
     const runsFailSuspendedExpiredCheckpointGuard = createThrottledReaperCatch("runs_fail_suspended_expired_checkpoint", logger);
     const runDenySweepGuard = createThrottledReaperCatch("run_deny_sweep", logger);
@@ -186,36 +96,20 @@ export function startReapers(ctx) {
     const workflowNotifyJournalReapAckedGuard = createThrottledReaperCatch("workflow_notify_journal_reap_acked", logger);
     const bgAgentsReapGuard = createThrottledReaperCatch("bg_agents_reap", logger);
     const rosterReapOlderThanGuard = createThrottledReaperCatch("roster_reap_older_than", logger);
-    const leaderRunStaleGuard = createThrottledReaperCatch("leader_run_reap_stale", logger); // #193 车4 件1
-    // #193 车4 件1:陈旧 running 清算腿的店。合取 `config.leaderEnabled` —— 默认关的部署不注册这条腿
-    // (取不到店也一样,`?.` 让整条腿成为 no-op)。
+    const leaderRunStaleGuard = createThrottledReaperCatch("leader_run_reap_stale", logger);
     const leaderRunStore = config.leaderEnabled ? backend?.leaderRun?.() : undefined;
     const scratchpadSweepStaleGuard = createThrottledReaperCatch("scratchpad_sweep_stale", logger);
     const approvalReconcileGuard = createThrottledReaperCatch("approval_reconcile", logger);
     const permissionRuleReapGuard = createThrottledReaperCatch("permission_rule_reap_expired", logger);
-    let permissionRuleReapInFlight = false; // A-010.17 / codex R2:重入守卫(邻居四腿同形,理由见调用点)
-    let approvalReconcileInFlight = false; // 车5 §8 C-8:重入守卫(邻居四先例同形——本腿时长随 PARKING 行数增长)
-    // #151 车5(design/172 §3.0 对账收敛器 + 崩溃恢复扫描):建腿条件 = 开关开 ∧ **有 `StoreBackend`**
-    // (见下方判据行 —— 是**任意** backend,不限 SQL twins:`local` 车道也算,它的 `approvalAsk()` 是进程内
-    // `InMemoryApprovalAskStore`,扫的是内存不是库)。无 backend 或显式关 ⇒ 本腿根本不注册,零扫描。
-    // ⚠️ 运维读数已反转:总开关默认**在树上已是 ON**(发布线上落在 7.4.0 之后的下一发布;版本坐标与
-    // 「别按 /health 版本号推默认」的告诫见属主 config.ts 的 `streamApprovalConfig()` 头注),
-    // 所以「零新增扫描」从**默认态**变成了 **opt-out 态** —— 任何配了 backend 的部署(含单用户 local)
-    // 默认都会注册本腿并每 tick 扫两段(PARKING + 孤儿 STREAM_PENDING,每段
-    // `STREAM_APPROVAL_RECONCILE_BATCH` 行,默认 200);SQL twins 上这就是**真新增的周期性查询**,local 上
-    // 只是内存遍历。存量部署升级后要回到零扫描,需显式把开关关掉。
-    // 判据 1/2 的两个读口按能力面接:checkpoint 店的窄读口只有 SQL twins 有(local 车道的店没有这个面),
-    // 缺席 ⇒ 判据 1 恒不命中(诚实降级,行落 ②③④⑤),不是「假装没 checkpoint 就该 DENY」。
+    let permissionRuleReapInFlight = false;
+    let approvalReconcileInFlight = false;
     const approvalReconciler = (() => {
         if (!config.streamApproval.enabled || !backend)
             return undefined;
-        // duck probe(邻居同形:本文件 `sweepStagingSessions` / `reapAllScopes` 都是这个姿势)——
-        // `CheckpointStoreFull` 的 local 成员没有这个窄读口,它是 SQL twins 的扩展面。
         const cpPort = checkpointStore;
         return createApprovalReconciler({
             askStore: backend.approvalAsk(),
             checkpoints: typeof cpPort?.findCheckpointCandidatesForAsk === "function" ? cpPort : undefined,
-            // RunStore 三形(TiDB/Pg/File)都带 `getRun`,故直接接、无 probe。
             runs: runStore,
             logger,
             metrics,
@@ -226,21 +120,6 @@ export function startReapers(ctx) {
             ...(toolApproval ? { emitRevoke: (frame, target) => void toolApproval.emitRevoke(frame, target) } : {}),
         });
     })();
-    // core 1.364([1503] 提货单③):retention **只走** reapDurableAgents(联合 reap:条件删赢了才 release
-    // 转录 session;裸 store.reap 会 strand 转录)。staleRunning 翻转在 core 编排内先行(store.reap 一步)。
-    // scope 枚举:core 1.368 `BackgroundAgentStore.listScopes?()`([1516]② 交付,SQL twins/File 双实现
-    // 都带)——1.248 拍的「file 腿只扫 default」假设已撤;无该方法的第三方 store 仍回落 "default"(可选
-    // 接口成员,诚实回落)。
-    // sessions=subRunner.sessions —— [1522] 裁定件(③ 显式裁定形,双店真相考据后拍):bg 子代转录会话
-    // 是**双店**(ForkRoutingSessionStore):①非 fork 子代铸在 transient 店(TtlSessionStore,进程内
-    // 1h TTL)——release=内存删=**真正终结可寻址性**(转录本就不 durable;跨实例读面读的是行内
-    // finalOutput,非转录);②fork 子代铸在 host durable 店——release=lease 释放,durable 转录行**有意
-    // 保留**,留存归 session 留存策略/E21 purge 生命周期管(行先删可接受:行是执行记录,转录是会话资产,
-    // 两者生命周期本就不同)。core [1522] 复审只见 durable 腿判 HIGH——按其契约句「做不到终结可寻址性
-    // 宁可不传」,transient 类做得到、fork 类是显式裁定,维持传入。sessionsReleased 计数=「store 侧
-    // release 被调次数」(transient=真删,durable=lease 释放),非「durable 转录处置数」——如实注。
-    // 复审 F4 如实注:条件删的赢者若非写者副本,fork-routing 对未知 id 回落 transient=本地 no-op,写者
-    // 进程内 pinned 转录滞留到自身 TTL/进程退出——sessionsReleased 计数偏低是诚实读数,非缺陷。
     const reapSessions = createPlacementAwareReapSessions({ host: backend?.session(), routed: subRunner.sessions });
     const reapBgAgents = backgroundAgentStore
         ? async () => {
@@ -248,21 +127,7 @@ export function startReapers(ctx) {
             const scopes = await (store.listScopes?.() ?? Promise.resolve(["default"]));
             let rows = 0, sessions = 0, skipped = 0, failedScopes = 0, orphanPlaced = 0;
             for (const scope of scopes) {
-                // [1522] LOW3:per-scope 错误隔离——一个 scope 抛(坏 record_json/权限)不饿死后续 scope;
-                // 失败响亮(warn+计数),下 tick 重试。
                 try {
-                    // core 1.382([1561] 提货单④,design/153 parked 状态机对账):先对账 parked 行(checkpoint
-                    // expired/missing → 行诚实翻 failed;stale claim → 回滚 parked),再让下面既有的
-                    // reapDurableAgents 按自然节奏处置(刚翻 failed 的行本 tick 不会立刻被 maxAge 删——它是
-                    // "刚失败"的新行,不是"失败很久"的老行)。**走 registry 面**(裂脑 fence 内建于
-                    // TaskRegistry.reconcileParkedAgents 内部,不裸调 store 面——那是无活实例场景专用,core
-                    // [1561]④ 措辞)。仅在 checkpointStore 真在场时跑(同 [1561]①②「同车必接」判据——没有
-                    // checkpointStore 就不可能有真正 parked 的行,调用本身没有意义)。
-                    // 🔴 [1575] F1 修(cli 复查,红先行确认):`opts.staleClaimMaxAgeMs` 必须显式传——core 把
-                    // 整个 stale-claim 清算块(claimer 崩死回滚 + resolved-未-finalize 诚实翻 failed)门在
-                    // `staleMs !== undefined` 上,缺席不是"跳过 stale-claim 这一小步",是**整块永不运行**
-                    // (此前漏传,`bg_agents_park_reconciled_rolledback_total` 恒 0,人已做出的审批决定会被
-                    // 静默丢弃——见 config.ts backgroundAgentParkClaimStaleMs 顶注)。
                     if (checkpointStore) {
                         const pr = await defaultTaskRegistry.reconcileParkedAgents({ agentStore: store, checkpointStore }, scope, Date.now(), { staleClaimMaxAgeMs: config.backgroundAgentParkClaimStaleMs });
                         if (pr.failed > 0 || pr.rolledBack > 0) {
@@ -271,8 +136,6 @@ export function startReapers(ctx) {
                             logger.info("reaper_swept", { metric: "bg_agents_park_reconciled", scope, failed: pr.failed, rolledBack: pr.rolledBack });
                         }
                     }
-                    // deps.mailbox(core 1.374,[1533]②):行删联动 F-13——agent 行 reap 时同 drop 其信箱
-                    // (盒生命周期随行终结;不挂=信箱行无 retention 无界涨)。
                     const r = await defaultTaskRegistry.reapDurableAgents(scope, { store, sessions: reapSessions, ...(mailboxStore ? { mailbox: mailboxStore } : {}) }, {
                         maxAgeMs: config.backgroundAgentRetentionMs,
                         staleRunningMaxAgeMs: config.backgroundAgentStaleRunningMs,
@@ -284,25 +147,15 @@ export function startReapers(ctx) {
                 }
                 catch (err) {
                     failedScopes++;
-                    // codex 交叉复审第三轮真发现(2026-08-05):a poison `err` (throwing `Symbol.toPrimitive`/`toString`)
-                    // or a throwing `logger.warn` must not escape THIS catch — the outer `bgAgentsReapGuard` (this
-                    // car's own wiring) already stops it from becoming an unhandled rejection, but an uncaught throw
-                    // HERE would abort the `for` loop early and skip every remaining scope, defeating the per-scope
-                    // isolation this block exists for ("[1522] LOW3" above — one bad scope must not starve the rest).
                     try {
                         logger.warn("bg_agent_reap_scope_failed", { scope, err: err instanceof Error ? err.message : String(err) });
                     }
                     catch {
-                        // observability must never break the per-scope loop — see comment above.
                     }
                 }
             }
             if (failedScopes > 0)
                 metrics.inc("bg_agent_reap_scope_failures_total", {}, failedScopes);
-            // #292:`orphanPlacedReleased` 是**独立的读数**(分区腿的产出),不折进 `sessionsReleased`
-            // ——两者回答的是不同的问题(「行驱动地释放了几条」vs「行已不在、从分区侧收掉了几条」),
-            // 相加会让「行与会话同亡的联合 reap 是否健康」这条判读永久失去分辨率。行数为 0 但分区腿有
-            // 收成时也要出线(那正是 reap 失败/漏跑留下的历史欠账被追平的时刻)。
             if (orphanPlaced > 0)
                 metrics.inc("bg_agents_orphan_placed_released_total", {}, orphanPlaced);
             if (rows > 0 || sessions > 0 || orphanPlaced > 0) {
@@ -311,12 +164,7 @@ export function startReapers(ctx) {
             }
         }
         : undefined;
-    // S10 (SILENT-FALLBACK P1): the write-behind counters bucket on LOCAL floor(now/windowMs) — replica clock
-    // skew vs the DB splits a fleet window into disjoint buckets (soft-limit leak) with zero visibility. Probe
-    // the DB clock each reaper tick; the gauge is the fleet-wide skew fingerprint (can be negative).
     const probeClockSkew = async () => {
-        // Probe-ok gauge: a failing probe froze the skew gauge at its last value with zero signal —
-        // "probe ran, skew=N" vs "probe failing for 30 min" were indistinguishable.
         try {
             const dbMs = await backend?.dbNowMs?.();
             if (typeof dbMs === "number" && Number.isFinite(dbMs)) {
@@ -330,43 +178,22 @@ export function startReapers(ctx) {
     };
     let quiesceLogged = false;
     const reaper = setInterval(() => {
-        // 🔴 A-010.18(验真后修):**收编弧跑动期间整轮让路**。design/183 I1「引擎先停」此前在进程内
-        // 零执法 —— 弧在逐表 UPDATE 的同时,本 tick 的好几条腿写的正是被迁的那些表。最锋利的是审批收敛器:
-        // 它按 `owner` 读出一批行再 CAS 结算,而收编正在把 `approval_ask.owner` 从 A 改成 B ⇒ 一只本该
-        // PARKED 的 ask 可能被写成 **DENIED**,而 DENIED 是终局(收编回滚不了它,重跑也追认不回来)。
-        // 为什么让开**整轮**而不是挑腿避让、以及「只挡本副本」这条射程边界,逐字见 `adoption/quiesce.ts`。
-        // 让路是零代价的:每条腿都幂等、都能等下一轮,而弧是毫秒级的几条 UPDATE。
         if (isAdoptionQuiescing()) {
             if (!quiesceLogged) {
-                quiesceLogged = true; // 一次性 —— 弧毫秒级,逐 tick 刷屏没有信息量
+                quiesceLogged = true;
                 logger.info("reaper_tick_yielded_to_adoption", {
-                    // 文案只说**兑得出来**的话(codex R1 [high] 的教训):本行保证的是「不再**起飞**新腿」。
-                    // 已经在飞的那些由弧侧的有界排空负责等,等不到会另打一条 `adoption_maintenance_drain_timeout`
-                    // —— 两条读数合起来才是全貌,所以这一行不许自称「没有任何腿在写被迁的表」。
                     note: "an adoption arc is running in this process; the maintenance tick launches NO new legs for its duration. Legs already airborne when the arc began are waited on separately (bounded) — see adoption_maintenance_drain_timeout if that wait ran out (design/183 I1, in-process half)",
                 });
             }
             return;
         }
         quiesceLogged = false;
-        leg(probeClockSkew().then(() => probeClockSkewGuard.onSuccess(), probeClockSkewGuard.onError)); // S10
+        leg(probeClockSkew().then(() => probeClockSkewGuard.onSuccess(), probeClockSkewGuard.onError));
         leg(runStore
             ?.reapStale(config.runStaleSec * 1000)
             .then(reapCount("runs_reaped_total", { kind: "stale" }))
             .then(() => runsReapStaleGuard.onSuccess(), runsReapStaleGuard.onError));
-        // Durable F4 (design/45) + design/80 §3 inv#3 crash-safe backstop: CAS-expire checkpoints past their
-        // deadline OR their absolute terminal_at_ms backstop (≈ deny), then fail the suspended run rows whose
-        // checkpoint was thereby expired (release task_active = unlock the session). These run EVERY tick,
-        // REGARDLESS of APPROVAL_TIMEOUT_SEC — terminal_at_ms (stamped at put, never before an explicit deadline)
-        // bounds even a NULL-deadline pending checkpoint, so the backstop is the always-on safety net (it was
-        // inert when nested under the approvalTimeoutSec>0 guard — adversarial finding). The run-row half is
-        // checkpoint-STATE-driven (not a uniform timer) so it aligns with the per-row terminal_at_ms. Global +
-        // idempotent across replicas, no election.
         if (checkpointStore) {
-            // 轴A #5 注释落档(1.254):core CheckpointStore.reap 契约把弃置臂的 unpin 义务派给部署 reaper——
-            // 真 pin 只存在于 in-memory TtlSessionStore;本部署 durable checkpoint 恒配 durable session 后端
-            // (pin=no-op),deny-sweep 走 resumeCheckpoint=core 内部 unpin ✓。SESSION_BACKEND=memory+durable
-            // checkpoint 的 niche dev 组合下 abort-expire 臂会把被钉会话泄到进程终——显式接受,不为 dev 形加腿。
             leg(checkpointStore
                 .reapExpired(Date.now())
                 .then(reapCount("checkpoints_reaped_total", {}))
@@ -375,49 +202,31 @@ export function startReapers(ctx) {
                 ?.failSuspendedWithExpiredCheckpoint()
                 .then(reapCount("runs_reaped_total", { kind: "expired_checkpoint" }))
                 .then(() => runsFailSuspendedExpiredCheckpointGuard.onSuccess(), runsFailSuspendedExpiredCheckpointGuard.onError));
-            // D-D SLA-timer: resolve-DENY human/irreversible_ask gates past their deadline (graceful — the model
-            // continues with the denial), vs the abort reapExpired gives the other kinds. Bounded per tick.
             leg(getRunDenySweep()?.(Date.now())
-                .then(() => runDenySweepGuard.onSuccess(), runDenySweepGuard.onError)); // A10 搬运改写:晚绑取值(原 `runDenySweep?.`)
+                .then(() => runDenySweepGuard.onSuccess(), runDenySweepGuard.onError));
         }
-        // The finer, OPT-IN time-based suspended-run reaper (APPROVAL_TIMEOUT_SEC). Stays gated — reapSuspended
-        // with a 0 TTL would nuke ALL suspended rows (cutoff = now). The absolute backstop above is the safety
-        // floor; this is the operator-chosen deadline. ([2354] A-5:F4 轮询店的 expireStale 腿随车道退役。)
         if (config.approvalTimeoutSec > 0) {
             leg(runStore
                 ?.reapSuspended(config.approvalTimeoutSec * 1000)
                 .then(reapCount("runs_reaped_total", { kind: "suspended" }))
                 .then(() => runsReapSuspendedGuard.onSuccess(), runsReapSuspendedGuard.onError));
         }
-        // GC checkpoint_ctx rows whose checkpoint is gone (bound to the checkpoint lifecycle).
         leg(checkpointStore
             ?.reapCtx(Date.now() - config.runStaleSec * 1000)
             .then(() => checkpointReapCtxGuard.onSuccess(), checkpointReapCtxGuard.onError));
         rateLimiter?.sweep();
         if (costQuota instanceof CostQuota)
-            costQuota.reap(); // TiDB variant self-reaps in its flush loop
+            costQuota.reap();
         leg(toolResultStore
             ?.reapOlderThan?.(Date.now() - config.toolResultTtlSec * 1000)
-            ?.then(() => toolResultReapOlderThanGuard.onSuccess(), toolResultReapOlderThanGuard.onError)); // optional extra: SQL twins only (the local FileToolResultStore persists like transcripts)
-        // 2c session-sync: GLOBALLY GC grace-window orphan blobs (standalone /sync/blobs PUTs that were never
-        // imported are otherwise collected only on reap()/deleteBySession(), which never fire for a never-imported scope).
-        // Bounds the standalone-PUT orphan-blob exhaustion (review finding) to the grace window. Durable twins only (local
-        // omits the seam → optional-chained no-op).
+            ?.then(() => toolResultReapOlderThanGuard.onSuccess(), toolResultReapOlderThanGuard.onError));
         leg(fileSnapshotStore
             ?.sweepOrphanBlobs?.()
             .then(() => fileSnapshotSweepOrphanBlobsGuard.onSuccess(), fileSnapshotSweepOrphanBlobsGuard.onError));
-        // D-1 附件 TTL:上传后从未被任何 task 引用(session_id NULL)且超过 attachmentUnboundTtlMs 的行收割
-        // (绑定行不在此收——随会话 E21 级联删)。best-effort,与其余 reaper 腿同姿。
         leg(taskAttachmentStore
             ?.reapUnbound(Date.now() - config.attachmentUnboundTtlMs)
             .then(reapCount("attachments_reaped_total", {}))
             .then(() => attachmentReapUnboundGuard.onSuccess(), attachmentReapUnboundGuard.onError));
-        // D-1 孤儿**对象**彻底 GC(clay 拍 2026-07-28):对象存储 × meta 行对账,grace 默认 1h(上传先行窗
-        // 保护;`ATTACHMENT_ORPHAN_GRACE_MS=0` 关掉本腿——同 tick 邻居都有旋钮,复审 F10)。
-        // 列举失败=本轮 warn 跳过(「列不出来」绝不当「没有孤儿」),下轮再试。
-        // 🔴 复审 F1:必须 in-flight 守卫——本腿时长随对象总数增长(20 万对象实测秒级、百万级可达 30s),
-        // 无守卫时超过 tick 间隔即逐 tick 叠加(实测叠 6 层),同时压 LIST/SQL/DELETE 三面。邻居
-        // wfRunReap/bgAgentReap 都有同款守卫。
         if (config.attachmentOrphanGraceMs > 0 && !attachmentSweepInFlight && taskAttachmentStore?.sweepOrphanObjects) {
             attachmentSweepInFlight = true;
             leg(taskAttachmentStore
@@ -427,65 +236,32 @@ export function startReapers(ctx) {
                 logger.info("attachment_orphan_objects_swept", { removed: n });
             } })
                 .catch((err) => {
-                // codex 交叉复审第二轮真发现(2026-08-05):`String(err)` on a pathological rejection reason or a
-                // throwing `logger.warn` transport must not escape THIS handler — this `.catch` sits ahead of a
-                // `.finally()` with no further `.catch` downstream, so an uncaught throw here becomes a floating
-                // rejected promise (unhandled rejection under Node's default handling). Same invariant as
-                // createThrottledReaperCatch.onError above: a reaper leg's failure REPORTING must never itself
-                // crash the tick loop.
                 try {
                     logger.warn("attachment_orphan_sweep_failed", { err: err instanceof Error ? err.message : String(err) });
                 }
                 catch {
-                    // observability must never crash the tick — see comment above.
                 }
             })
                 .finally(() => { attachmentSweepInFlight = false; }));
         }
-        // P1d-β 2c session-sync: GC ABANDONED staged imports — staging-id session_event rows (`%#stg-%`) with NO
-        // session_meta whose oldest row is older than the grace window (an in-flight stream stays fresh → never reaped).
-        // Bounds the orphan-staging-row growth (a Phase B that opened a staging then never committed). Durable session
-        // stores only (the local backend stages in memory → no durable rows; the seam is absent → optional-chained no-op).
         leg(backend?.session()?.sweepStagingSessions?.()
             .then(() => sessionSweepStagingGuard.onSuccess(), sessionSweepStagingGuard.onError));
-        // Bake-runner backstop (§P2.7): fail any `running` bake whose lease went stale (the runner crashed mid-build),
-        // append a synthetic terminal `done{failed}` so SSE readers settle, and force-release the single-flight lease.
-        // staleMs (≈3× the 30s heartbeat) bounds a healthy slow build so it is never wrongly reaped.
         leg(imageBakes
             ?.reapStaleBakes(config.imageBakes.staleMs)
             .then(reapCount("bakes_reaped_total", {}))
             .then(() => imageBakesReapStaleGuard.onSuccess(), imageBakesReapStaleGuard.onError));
-        // SVC-3 worktree isolation: deregister worktrees orphaned by a process crash (the Runner never reached
-        // destroy → `git worktree remove` never ran). `git worktree prune` cleans registrations whose dirs are
-        // already gone. Best-effort, userland (core ships no post-kill Runner hook); never throws. Unset = no-op.
-        // 🔴 A10 留档发现①(review 2026-07-29):必须 in-flight 守卫——`git worktree prune` 随仓内 worktree
-        // 总数/子代并发度增长可变慢,无守卫时超过 tick 间隔即在下一 tick 被重入叠跑(邻居
-        // attachmentSweep/wfRunReap/bgAgentReap 三个 sweep 都已有同款守卫,此腿此前是唯一漏配的)。
-        // 照抄 bgAgentReap 的 in-flight + finally 释放形。
         if (worktreeReap && !worktreeReapInFlight) {
             worktreeReapInFlight = true;
             leg(worktreeReap()
                 .then(() => worktreeReapGuard.onSuccess(), worktreeReapGuard.onError)
                 .finally(() => (worktreeReapInFlight = false)));
         }
-        // SVC-1 (adversarial-review HIGH): PERIODIC notify-recovery sweep (not just at boot) — re-delivers a terminal
-        // run whose in-process notify was lost, AND finalizes-as-abandoned a `running` run orphaned past the grace
-        // window (core never resumes/reaps a prior `running` row, so nothing else would). Idempotent; best-effort.
         leg(workflowNotifyGate
             ?.recover(workflowRecoverOpts)
             .then(() => workflowNotifyRecoverGuard.onSuccess(), workflowNotifyRecoverGuard.onError));
-        // SVC-2 (adversarial-review HIGH): time-based GC of the workflow_journal table (the heaviest, TaskResult-bearing
-        // one) — the per-run deleteByRun has no run-store reap hook, so this bounded sweep is what stops unbounded
-        // growth. A resume of a journal older than the retention window re-runs live (resume is an optimization).
         leg(workflowJournalStore
             ?.reapExpired?.(Date.now(), config.workflowJournalRetentionMs)
             .then(() => workflowJournalReapExpiredGuard.onSuccess(), workflowJournalReapExpiredGuard.onError));
-        // Retention (WorkflowRunStore never auto-purges, reap is explicit):
-        // age out TERMINAL workflow_run rows across ALL scopes. SQL twins only (reapAllScopes is their DISTINCT-scope
-        // extension; the contract itself has no cross-scope enumeration, and the File store keeps the transcripts-like
-        // keep-everything posture). Running rows are untouched — the orphan-grace sweep above owns those.
-        // In-flight guard (1.108 review, lens③): the sweep enumerates EVERY scope serially — under a short
-        // REAP_INTERVAL_SEC + many scopes, overlapping sweeps would pile up on the pool. One at a time.
         if (!wfRunReapInFlight) {
             const sweep = sqlWorkflowRunStore?.reapAllScopes?.(Date.now(), { maxAgeMs: config.workflowRunRetentionMs });
             if (sweep) {
@@ -494,43 +270,24 @@ export function startReapers(ctx) {
                     .then(() => workflowRunReapAllScopesGuard.onSuccess(), workflowRunReapAllScopesGuard.onError)
                     .finally(() => (wfRunReapInFlight = false)));
             }
-            // 1.108: SQL notify-journal retention rides the same knob — ACKED rows are pure history (pending rows are
-            // the recovery backlog and are NEVER reaped; the orphan-grace sweep retires a stuck pending run).
             leg(workflowNotifyJournal
                 ?.reapAcked?.(Date.now() - config.workflowRunRetentionMs)
                 .then(() => workflowNotifyJournalReapAckedGuard.onSuccess(), workflowNotifyJournalReapAckedGuard.onError));
         }
-        // core 1.364 durable bg-agent joint reap(定义在 interval 上方,契约注释在彼)。in-flight 守卫同
-        // wfRun sweep(per-scope 串行循环,短 tick + 多 scope 下不叠罗汉)。
         if (reapBgAgents && !bgAgentReapInFlight) {
             bgAgentReapInFlight = true;
             leg(reapBgAgents()
                 .then(() => bgAgentsReapGuard.onSuccess(), bgAgentsReapGuard.onError)
                 .finally(() => (bgAgentReapInFlight = false)));
         }
-        // [1522] MED2:agent_roster TTL 清理(core RB-23②③ 派给部署的半场)——SQL twins 扩展面
-        // (reapOlderThan,duck probe;File/Memory 店 core 自带 maxAgeMs,无此面=no-op)。
         leg(rosterStore
             ?.reapOlderThan?.(Date.now() - config.rosterRetentionMs)
             .then(reapCount("roster_rows_reaped_total", {}))
             .then(() => rosterReapOlderThanGuard.onSuccess(), rosterReapOlderThanGuard.onError));
-        // #193 车4 件1(codex 对抗复审 R1-high②):陈旧 `running` leader run 的清算 —— 驱动它的副本死了,
-        // 行会永远停在 `running`(跨副本读面显示「在跑」而没有任何东西在跑)。到期迁 `failed` 并写清 WHY。
-        // **不是接管**(理由见 leader-run-store-sql.ts 的 reapStaleRunning 头注)。腿只在开了 leader 的
-        // 部署上注册:`leaderRunStore` 是 `config.leaderEnabled && backend?.leaderRun?.()` 的合取(见上面
-        // 的取值处),默认关的部署零扫描。
         leg(leaderRunStore
             ?.reapStaleRunning(config.leaderRunStaleMs, Date.now())
             .then(reapCount("leader_runs_stale_reaped_total", {}))
             .then(() => leaderRunStaleGuard.onSuccess(), leaderRunStaleGuard.onError));
-        // 修8(三路复审 absorb-2,接线 (b)):periodic scratchpad sweep — 无 E21 purge 兜到的孤儿目录(session 从未
-        // DELETE、purge 当次失败、local 后端无 purge coordinator)按 mtime 过期回收。SCRATCHPAD_SWEEP_TTL_MS
-        // (default 7d,0=禁用)。activeSessionIds 不传:活跃判据的诚实边界在 env-facts.ts 的 sweep 文档——TTL 7d
-        // 远大于任何在飞任务;一个 7 天零写入的 scratchpad 被回收是可接受的(它本就是临时区,fact 文案即如此宣示)。
-        // #151 车5:流内审批的对账收敛器 + 崩溃恢复扫描(两段都在 `runOnce` 内,见 approval-reconciler.ts
-        // 判据表 v2)。**不新起独立定时器**——复用本 tick(收敛延迟上界 = 一个 reaper tick;壳侧的体感由
-        // 车4 的 425 `Retry-After` 覆盖)。in-flight 守卫同邻居四腿:本腿时长随 PARKING 行数与两个读口的
-        // 库延迟增长,短 REAP_INTERVAL_SEC 下无守卫会逐 tick 叠罗汉压同一批行。
         if (approvalReconciler && !approvalReconcileInFlight) {
             approvalReconcileInFlight = true;
             leg(approvalReconciler
@@ -538,16 +295,6 @@ export function startReapers(ctx) {
                 .then(() => approvalReconcileGuard.onSuccess(), approvalReconcileGuard.onError)
                 .finally(() => (approvalReconcileInFlight = false)));
         }
-        // A-010.17:规则店的保留期腿。**只删可证已死的行**(过期导入票 + 超期孤儿 pending 记录)——
-        // 谓词、每轮上界、以及「为什么这条腿不需要旋钮」逐字见 `plugins/permission-rule-store-sql.ts`
-        // 的 `reapExpired` / `RULE_REAP_BATCH`。
-        // `?.` 的缺席臂 = File 车道没有这一面(如实登记在 `rules-consent.ts` 的接口注里,不是漏接)。
-        //
-        // 🔴 重入守卫(codex 对抗复审 R2 [high],验真后修):第一版按「两条等值 DELETE,时长不随在飞量增长」
-        // 判定无需守卫 —— 那句话**不成立**。`permission_rule_approval` 按设计永久留审计事实(只增不减),
-        // 而 MySQL 存量库在删库重建之前拿不到新加的清扫索引 ⇒ 这条腿的时长会随**审计史**增长。一旦越过
-        // tick 间隔,下一轮就叠在同一批行上。判据与邻居四腿(attachmentSweep / wfRunReap / bgAgentReap /
-        // worktreeReap)同形。
         if (!permissionRuleReapInFlight) {
             permissionRuleReapInFlight = true;
             leg(permissionRuleStores
@@ -555,8 +302,6 @@ export function startReapers(ctx) {
                 .then(reapCount("permission_rules_reaped_total", {}))
                 .then(() => permissionRuleReapGuard.onSuccess(), permissionRuleReapGuard.onError)
                 .finally(() => (permissionRuleReapInFlight = false)));
-            // 店缺席(File 车道 / 关旋钮)⇒ 上面整条求值成 undefined、`finally` 永不跑 ⇒ 守卫要当场归位,
-            // 否则第一轮之后这条腿就被自己的守卫永久锁死(而它本来就该零调用,锁死是静默的)。
             if (permissionRuleStores?.reapExpired === undefined)
                 permissionRuleReapInFlight = false;
         }
@@ -568,9 +313,6 @@ export function startReapers(ctx) {
             })
                 .then(() => scratchpadSweepStaleGuard.onSuccess(), scratchpadSweepStaleGuard.onError));
         }
-        // #242(design/242 v1):E2B 孤儿沙盒回收。tick 内**时间节流**到 GRACE 周期(每 tick 打一次
-        // provider list API 是浪费——孤儿的时间尺度是分钟级);首轮在进程起后第一个 tick 就跑(boot 半场,
-        // 不单开 boot 调用点)。判据/边界全在 e2b-orphan-reclaim.ts;这里只管节流+重入+throttled catch。
         if (e2bOrphanProvider && runStore && Date.now() - e2bOrphanLastRunMs >= E2B_ORPHAN_GRACE_MS && !e2bOrphanInFlight) {
             e2bOrphanInFlight = true;
             e2bOrphanLastRunMs = Date.now();