@runa-ai/runa-cli 0.6.0 → 0.7.1

package/dist/{ci-V3PIG2GI.js → ci-XY6IKEDC.js}

@@ -1,18 +1,19 @@
 #!/usr/bin/env node
 import { createRequire } from 'module';
-import { normalizeDatabaseUrlForDdl, enhanceConnectionError, parseBoolish, parsePostgresUrl, buildPsqlArgs, buildPsqlEnv, detectAppSchemas, formatSchemasForSql } from './chunk-CE3DEYFT.js';
-import { detectEnvironment } from './chunk-JMJP4A47.js';
-import { ensureRunaTmpDir, runLogged } from './chunk-7QV7U6NI.js';
+import { normalizeDatabaseUrlForDdl, parseBoolish, enhanceConnectionError, detectAppSchemas, formatSchemasForSql } from './chunk-XDCHRVE3.js';
+import { isPathContained } from './chunk-DRSUEMAK.js';
 import './chunk-QDF7QXBL.js';
-import { getSnapshotStateName, isSnapshotComplete } from './chunk-IBVVGH6X.js';
-import { getSafeEnv, getFilteredEnv, redactSecrets } from './chunk-II7VYQEM.js';
+import { getSnapshotStateName, isSnapshotComplete } from './chunk-EMB6IZFT.js';
 import { writeEnvLocal, startAppBackground, waitForAppReady, executePrSetupBase, createErrorOutput } from './chunk-HD74F6W2.js';
+import { parsePostgresUrl, buildPsqlArgs, buildPsqlEnv, psqlSyncQuery } from './chunk-7B5C6U2K.js';
+import { ensureRunaTmpDir, runLogged } from './chunk-6FAU4IGR.js';
+import { createMachineStateChangeLogger } from './chunk-5FT3F36G.js';
+import { getSafeEnv, getFilteredEnv, redactSecrets } from './chunk-II7VYQEM.js';
 import { init_constants, detectSupabasePorts } from './chunk-VM3IWOT5.js';
-import { isPathContained } from './chunk-DRSUEMAK.js';
-import { emitJsonSuccess } from './chunk-UU55OH7P.js';
-import './chunk-RRGQCUKT.js';
-import './chunk-JT5SUTWE.js';
+import { emitJsonSuccess } from './chunk-KE6QJBZG.js';
+import './chunk-WJXC4MVY.js';
 import { setOutputFormat } from './chunk-HKUWEGUX.js';
+import { detectEnvironment } from './chunk-JMJP4A47.js';
 import { init_esm_shims, __require } from './chunk-VRXHCR5K.js';
 import { Command } from 'commander';
 import { spawnSync, spawn, execFileSync } from 'child_process';
@@ -24,9 +25,9 @@ import { existsSync, readFileSync, readdirSync, promises, lstatSync, statSync }
 import { resolve4 } from 'dns/promises';
 import net, { isIP } from 'net';
 import { fromPromise, setup, assign, createActor } from 'xstate';
-import postgres from 'postgres';
+import { randomUUID, createHash } from 'crypto';
 import { execa } from 'execa';
-import 'crypto';
+import postgres from 'postgres';
 import { glob } from 'glob';
 
 createRequire(import.meta.url);
@@ -1883,24 +1884,41 @@ var ciProdApplyCommand = new Command("prod-apply").description("Apply production
 
 // src/commands/ci/commands/ci-static.ts
 init_esm_shims();
-function getChecks() {
-  return [
-    {
+function hasNativeActionlint() {
+  try {
+    const result = spawnSync("actionlint", ["-version"], {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "pipe"],
+      timeout: 5e3
+    });
+    return result.status === 0;
+  } catch {
+    return false;
+  }
+}
+function createActionlintCheck(mode) {
+  if (mode === "local" && hasNativeActionlint()) {
+    return {
       name: "actionlint",
       label: "Workflow Lint",
       description: "GitHub Actions syntax validation",
-      command: "docker",
-      args: [
-        "run",
-        "--rm",
-        "-v",
-        `${process.cwd()}:/repo`,
-        "-w",
-        "/repo",
-        "rhysd/actionlint:1.7.9"
-      ],
+      command: "actionlint",
+      args: ["-color"],
       category: "workflow"
-    },
+    };
+  }
+  return {
+    name: "actionlint",
+    label: "Workflow Lint",
+    description: "GitHub Actions syntax validation",
+    command: "docker",
+    args: ["run", "--rm", "-v", `${process.cwd()}:/repo`, "-w", "/repo", "rhysd/actionlint:1.7.9"],
+    category: "workflow"
+  };
+}
+function getChecks(mode) {
+  return [
+    createActionlintCheck(mode),
     {
       name: "type-check",
       label: "Type Check",
@@ -2013,7 +2031,7 @@ function buildStepSummaryMarkdown2(summary) {
   return lines.join("\n");
 }
 function getChecksToRun(options) {
-  let checks = getChecks().filter((c) => {
+  let checks = getChecks(options.mode).filter((c) => {
     if (c.category === "workflow") return true;
     if (c.category === "core") return true;
     if (c.category === "build") return options.includeBuild;
@@ -2498,9 +2516,434 @@ var applySeedsActor = fromPromise(
 // src/commands/ci/machine/actors/db/collect-schema-stats.ts
 init_esm_shims();
 
-// src/commands/ci/machine/actors/db/schema-stats.ts
+// src/commands/ci/machine/actors/db/schema-canonical-diff.ts
 init_esm_shims();
+function createUnavailableCanonicalSnapshot(error) {
+  return {
+    available: false,
+    objects: [],
+    error
+  };
+}
 var EXCLUDED_SCHEMAS = [
+  "pg_catalog",
+  "pg_toast",
+  "information_schema",
+  "auth",
+  "storage",
+  "realtime",
+  "_realtime",
+  "supabase_functions",
+  "supabase_migrations",
+  "vault",
+  "pgsodium",
+  "pgsodium_masks",
+  "graphql",
+  "graphql_public",
+  "extensions",
+  "net",
+  "cron",
+  "tests"
+];
+function normalizeWhitespace(value) {
+  return (value ?? "").replace(/\s+/g, " ").trim();
+}
+function stableHash(payload) {
+  return createHash("sha256").update(JSON.stringify(payload)).digest("hex").slice(0, 16);
+}
+function createCanonicalTableColumnPayload(row) {
+  return {
+    name: row.column_name,
+    type: normalizeWhitespace(row.data_type),
+    notNull: row.not_null,
+    default: normalizeWhitespace(row.default_expr),
+    identity: row.identity_kind ?? "",
+    generated: row.generated_kind ?? ""
+  };
+}
+function sortCanonicalTableColumns(columns) {
+  return [...columns].sort((left, right) => left.name.localeCompare(right.name));
+}
+function createCanonicalObject(kind, schema, name, label, payload, parentName) {
+  return {
+    kind,
+    schema,
+    name,
+    key: `${kind}:${schema}:${name}`,
+    label,
+    parentName,
+    signature: stableHash(payload)
+  };
+}
+function buildSchemaListSql(schemaNames) {
+  return schemaNames.map((schemaName) => `'${schemaName}'`).join(", ");
+}
+async function getUserSchemas(sql) {
+  const excludeList = buildSchemaListSql(EXCLUDED_SCHEMAS);
+  const rows = await sql`
+    SELECT nspname
+    FROM pg_namespace
+    WHERE nspname NOT IN (${sql.unsafe(excludeList)})
+      AND nspname NOT LIKE 'pg_%'
+    ORDER BY nspname
+  `;
+  return rows.map((row) => row.nspname);
+}
+async function queryTableColumns(sql, schemaList) {
+  return await sql`
+    SELECT
+      n.nspname AS schema_name,
+      c.relname AS table_name,
+      a.attnum::int AS attnum,
+      a.attname AS column_name,
+      format_type(a.atttypid, a.atttypmod) AS data_type,
+      a.attnotnull AS not_null,
+      pg_get_expr(ad.adbin, ad.adrelid, true) AS default_expr,
+      NULLIF(a.attidentity, '') AS identity_kind,
+      NULLIF(a.attgenerated, '') AS generated_kind
+    FROM pg_class c
+    JOIN pg_namespace n ON n.oid = c.relnamespace
+    JOIN pg_attribute a ON a.attrelid = c.oid
+    LEFT JOIN pg_attrdef ad ON ad.adrelid = c.oid AND ad.adnum = a.attnum
+    WHERE n.nspname IN (${sql.unsafe(schemaList)})
+      AND c.relkind IN ('r', 'p')
+      AND a.attnum > 0
+      AND NOT a.attisdropped
+    ORDER BY n.nspname, c.relname, a.attnum
+  `;
+}
+async function queryTableFlags(sql, schemaList) {
+  return await sql`
+    SELECT
+      n.nspname AS schema_name,
+      c.relname AS table_name,
+      c.relrowsecurity AS rls_enabled,
+      c.relforcerowsecurity AS rls_forced
+    FROM pg_class c
+    JOIN pg_namespace n ON n.oid = c.relnamespace
+    WHERE n.nspname IN (${sql.unsafe(schemaList)})
+      AND c.relkind IN ('r', 'p')
+  `;
+}
+async function queryTableConstraints(sql, schemaList) {
+  return await sql`
+    SELECT
+      n.nspname AS schema_name,
+      c.relname AS table_name,
+      con.conname AS constraint_name,
+      con.contype AS constraint_type,
+      pg_get_constraintdef(con.oid, true) AS definition
+    FROM pg_constraint con
+    JOIN pg_class c ON c.oid = con.conrelid
+    JOIN pg_namespace n ON n.oid = c.relnamespace
+    WHERE n.nspname IN (${sql.unsafe(schemaList)})
+      AND c.relkind IN ('r', 'p')
+    ORDER BY n.nspname, c.relname, con.conname
+  `;
+}
+function buildTableObjects(columns, flags, constraints) {
+  const tables = /* @__PURE__ */ new Map();
+  for (const row of columns) {
+    const key = `${row.schema_name}.${row.table_name}`;
+    const entry = tables.get(key) ?? {
+      schema: row.schema_name,
+      table: row.table_name,
+      columns: [],
+      constraints: [],
+      rlsEnabled: false,
+      rlsForced: false
+    };
+    entry.columns.push(createCanonicalTableColumnPayload(row));
+    tables.set(key, entry);
+  }
+  for (const row of flags) {
+    const key = `${row.schema_name}.${row.table_name}`;
+    const entry = tables.get(key) ?? {
+      schema: row.schema_name,
+      table: row.table_name,
+      columns: [],
+      constraints: [],
+      rlsEnabled: false,
+      rlsForced: false
+    };
+    entry.rlsEnabled = row.rls_enabled;
+    entry.rlsForced = row.rls_forced;
+    tables.set(key, entry);
+  }
+  for (const row of constraints) {
+    const key = `${row.schema_name}.${row.table_name}`;
+    const entry = tables.get(key) ?? {
+      schema: row.schema_name,
+      table: row.table_name,
+      columns: [],
+      constraints: [],
+      rlsEnabled: false,
+      rlsForced: false
+    };
+    entry.constraints.push({
+      name: row.constraint_name,
+      type: row.constraint_type,
+      definition: normalizeWhitespace(row.definition)
+    });
+    tables.set(key, entry);
+  }
+  return Array.from(tables.values()).map(
+    (table) => createCanonicalObject("table", table.schema, table.table, `${table.schema}.${table.table}`, {
+      columns: sortCanonicalTableColumns(table.columns),
+      constraints: table.constraints,
+      rlsEnabled: table.rlsEnabled,
+      rlsForced: table.rlsForced
+    })
+  );
+}
+async function queryFunctions(sql, schemaList) {
+  return await sql`
+    SELECT
+      n.nspname AS schema_name,
+      p.proname AS object_name,
+      format('%I.%I(%s)', n.nspname, p.proname, pg_get_function_identity_arguments(p.oid)) AS object_key,
+      format('%I.%I(%s)', n.nspname, p.proname, pg_get_function_identity_arguments(p.oid)) AS object_label,
+      pg_get_functiondef(p.oid) AS definition
+    FROM pg_proc p
+    JOIN pg_namespace n ON p.pronamespace = n.oid
+    WHERE n.nspname IN (${sql.unsafe(schemaList)})
+      AND p.prokind = 'f'
+      AND NOT EXISTS (
+        SELECT 1 FROM pg_depend d
+        WHERE d.objid = p.oid
+          AND d.deptype = 'e'
+      )
+      AND p.proname NOT LIKE 'supabase_%'
+      AND p.proname NOT LIKE 'postgrest_%'
+      AND p.proname NOT LIKE 'pgrst_%'
+      AND p.proname NOT LIKE '_pgrst_%'
+    ORDER BY n.nspname, p.proname
+  `;
+}
+async function queryPolicies(sql, schemaList) {
+  return await sql`
+    SELECT
+      schemaname AS schema_name,
+      policyname AS object_name,
+      format('%I.%I.%I', schemaname, tablename, policyname) AS object_key,
+      format('%I.%I policy %I', schemaname, tablename, policyname) AS object_label,
+      tablename AS parent_name,
+      jsonb_build_object(
+        'table', tablename,
+        'permissive', permissive,
+        'roles', COALESCE(roles, ARRAY[]::text[]),
+        'command', cmd,
+        'using', COALESCE(qual, ''),
+        'withCheck', COALESCE(with_check, '')
+      )::text AS definition
+    FROM pg_policies
+    WHERE schemaname IN (${sql.unsafe(schemaList)})
+    ORDER BY schemaname, tablename, policyname
+  `;
+}
+async function queryIndexes(sql, schemaList) {
+  return await sql`
+    SELECT
+      n.nspname AS schema_name,
+      i.relname AS object_name,
+      format('%I.%I', n.nspname, i.relname) AS object_key,
+      format('%I.%I on %I', n.nspname, i.relname, t.relname) AS object_label,
+      t.relname AS parent_name,
+      jsonb_build_object(
+        'table', t.relname,
+        'definition',
+        regexp_replace(pg_get_indexdef(i.oid), '^CREATE( UNIQUE)? INDEX [^ ]+ ON ', 'CREATE\\1 INDEX ON '),
+        'predicate',
+        COALESCE(pg_get_expr(idx.indpred, idx.indrelid, true), ''),
+        'unique',
+        idx.indisunique
+      )::text AS definition
+    FROM pg_index idx
+    JOIN pg_class i ON i.oid = idx.indexrelid
+    JOIN pg_class t ON t.oid = idx.indrelid
+    JOIN pg_namespace n ON n.oid = i.relnamespace
+    WHERE n.nspname IN (${sql.unsafe(schemaList)})
+      AND NOT EXISTS (
+        SELECT 1 FROM pg_constraint c
+        WHERE c.conindid = idx.indexrelid
+      )
+    ORDER BY n.nspname, t.relname, i.relname
+  `;
+}
+async function queryTriggers(sql, schemaList) {
+  return await sql`
+    SELECT
+      n.nspname AS schema_name,
+      t.tgname AS object_name,
+      format('%I.%I.%I', n.nspname, c.relname, t.tgname) AS object_key,
+      format('%I.%I trigger %I', n.nspname, c.relname, t.tgname) AS object_label,
+      c.relname AS parent_name,
+      pg_get_triggerdef(t.oid, true) AS definition
+    FROM pg_trigger t
+    JOIN pg_class c ON t.tgrelid = c.oid
+    JOIN pg_namespace n ON c.relnamespace = n.oid
+    WHERE n.nspname IN (${sql.unsafe(schemaList)})
+      AND NOT t.tgisinternal
+    ORDER BY n.nspname, c.relname, t.tgname
+  `;
+}
+function rowsToObjects(kind, rows) {
+  return rows.map(
+    (row) => createCanonicalObject(
+      kind,
+      row.schema_name,
+      row.object_key,
+      row.object_label,
+      normalizeWhitespace(row.definition),
+      row.parent_name ?? void 0
+    )
+  );
+}
+async function getCanonicalSchemaSnapshot(databaseUrl) {
+  let sql = null;
+  try {
+    const isRemoteSupabase = databaseUrl.includes(".supabase.co");
+    sql = postgres(databaseUrl, {
+      max: 1,
+      idle_timeout: 10,
+      connect_timeout: 10,
+      ...isRemoteSupabase && { ssl: "require" }
+    });
+    const userSchemas = await getUserSchemas(sql);
+    if (userSchemas.length === 0) {
+      return { available: true, objects: [] };
+    }
+    const schemaList = buildSchemaListSql(userSchemas);
+    const [columns, flags, constraints, functions, policies, indexes, triggers] = await Promise.all(
+      [
+        queryTableColumns(sql, schemaList),
+        queryTableFlags(sql, schemaList),
+        queryTableConstraints(sql, schemaList),
+        queryFunctions(sql, schemaList),
+        queryPolicies(sql, schemaList),
+        queryIndexes(sql, schemaList),
+        queryTriggers(sql, schemaList)
+      ]
+    );
+    return {
+      available: true,
+      objects: [
+        ...buildTableObjects(columns, flags, constraints),
+        ...rowsToObjects("function", functions),
+        ...rowsToObjects("policy", policies),
+        ...rowsToObjects("index", indexes),
+        ...rowsToObjects("trigger", triggers)
+      ].sort((a, b) => a.key.localeCompare(b.key))
+    };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    console.warn(`[schema-canonical-diff] Could not query canonical snapshot: ${message}`);
+    return createUnavailableCanonicalSnapshot(message);
+  } finally {
+    if (sql) {
+      await sql.end();
+    }
+  }
+}
+function buildObjectMap(snapshot) {
+  return new Map(snapshot.objects.map((object) => [object.key, object]));
+}
+function buildSignatureBuckets(objects) {
+  const buckets = /* @__PURE__ */ new Map();
+  for (const object of objects) {
+    const bucketKey = `${object.kind}:${object.schema}:${object.signature}`;
+    const current = buckets.get(bucketKey) ?? [];
+    current.push(object);
+    buckets.set(bucketKey, current);
+  }
+  return buckets;
+}
+function compareCanonicalSnapshots(reference, target) {
+  const missing = [];
+  const extra = [];
+  const changed = [];
+  const renamed = [];
+  const targetByKey = buildObjectMap(target);
+  const targetSignatureBuckets = buildSignatureBuckets(target.objects);
+  const matchedTargetKeys = /* @__PURE__ */ new Set();
+  for (const referenceObject of reference.objects) {
+    const matchedTarget = targetByKey.get(referenceObject.key);
+    if (matchedTarget) {
+      matchedTargetKeys.add(matchedTarget.key);
+      if (matchedTarget.signature !== referenceObject.signature) {
+        changed.push({ reference: referenceObject, target: matchedTarget });
+      }
+      continue;
+    }
+    if (referenceObject.kind === "index") {
+      const renameBucket = targetSignatureBuckets.get(
+        `${referenceObject.kind}:${referenceObject.schema}:${referenceObject.signature}`
+      ) ?? [];
+      const renamedTarget = renameBucket.find((candidate) => !matchedTargetKeys.has(candidate.key));
+      if (renamedTarget) {
+        matchedTargetKeys.add(renamedTarget.key);
+        renamed.push({ reference: referenceObject, target: renamedTarget });
+        continue;
+      }
+    }
+    missing.push(referenceObject);
+  }
+  for (const targetObject of target.objects) {
+    if (!matchedTargetKeys.has(targetObject.key) && !reference.objects.some((candidate) => candidate.key === targetObject.key)) {
+      extra.push(targetObject);
+    }
+  }
+  return { missing, extra, changed, renamed };
+}
+function addSummaryKind(summary, kind) {
+  if (!summary.changedKinds.includes(kind)) {
+    summary.changedKinds.push(kind);
+    summary.changedKinds.sort();
+  }
+  summary.hasChanges = true;
+}
+function ensureSchemaSummary(summaries, schemaName) {
+  const existing = summaries[schemaName];
+  if (existing) return existing;
+  const created = {
+    hasChanges: false,
+    changedKinds: [],
+    counts: { missing: 0, extra: 0, changed: 0, renamed: 0 }
+  };
+  summaries[schemaName] = created;
+  return created;
+}
+function summarizeCanonicalDiffBySchema(diff) {
+  const summaries = {};
+  for (const object of diff.missing) {
+    const summary = ensureSchemaSummary(summaries, object.schema);
+    summary.counts.missing += 1;
+    addSummaryKind(summary, object.kind);
+  }
+  for (const object of diff.extra) {
+    const summary = ensureSchemaSummary(summaries, object.schema);
+    summary.counts.extra += 1;
+    addSummaryKind(summary, object.kind);
+  }
+  for (const pair of diff.changed) {
+    const summary = ensureSchemaSummary(summaries, pair.reference.schema);
+    summary.counts.changed += 1;
+    addSummaryKind(summary, pair.reference.kind);
+  }
+  for (const pair of diff.renamed) {
+    const summary = ensureSchemaSummary(summaries, pair.reference.schema);
+    summary.counts.renamed += 1;
+    addSummaryKind(summary, pair.reference.kind);
+  }
+  return summaries;
+}
+function hasCanonicalChanges(diff) {
+  return diff.missing.length > 0 || diff.extra.length > 0 || diff.changed.length > 0 || diff.renamed.length > 0;
+}
+
+// src/commands/ci/machine/actors/db/schema-stats.ts
+init_esm_shims();
+var EXCLUDED_SCHEMAS2 = [
   // PostgreSQL system schemas
   "pg_catalog",
   "pg_toast",
@@ -2604,15 +3047,18 @@ async function getDetailedIndexList(sql, schemaList) {
       t.relname as table,
       idx.indisunique as is_unique,
       idx.indpred IS NOT NULL as is_partial,
+      am.amname as access_method,
       CASE
         WHEN idx.indpred IS NOT NULL
         THEN pg_get_expr(idx.indpred, idx.indrelid, true)
         ELSE NULL
-      END as where_clause
+      END as where_clause,
+      pg_get_indexdef(i.oid) as definition
     FROM pg_index idx
     JOIN pg_class i ON i.oid = idx.indexrelid
     JOIN pg_class t ON t.oid = idx.indrelid
     JOIN pg_namespace n ON n.oid = i.relnamespace
+    JOIN pg_am am ON am.oid = i.relam
     WHERE n.nspname IN (${sql.unsafe(schemaList)})
       AND NOT EXISTS (
         SELECT 1 FROM pg_constraint c
@@ -2626,11 +3072,13 @@ async function getDetailedIndexList(sql, schemaList) {
     table: row.table,
     isUnique: row.is_unique,
     isPartial: row.is_partial,
-    whereClause: row.where_clause || void 0
+    whereClause: row.where_clause || void 0,
+    accessMethod: row.access_method || void 0,
+    definition: normalizeIndexDefinition(row.definition || void 0)
   }));
 }
-async function getUserSchemas(sql) {
-  const excludeList = EXCLUDED_SCHEMAS.map((s) => `'${s}'`).join(", ");
+async function getUserSchemas2(sql) {
+  const excludeList = EXCLUDED_SCHEMAS2.map((s) => `'${s}'`).join(", ");
   const result = await sql`
     SELECT nspname
     FROM pg_namespace
@@ -2653,7 +3101,7 @@ async function getDbSchemaStats(databaseUrl) {
       // Supabase production requires SSL; local Docker does not
       ...isRemoteSupabase && { ssl: "require" }
     });
-    const userSchemas = await getUserSchemas(sql);
+    const userSchemas = await getUserSchemas2(sql);
     if (userSchemas.length === 0) {
       return { schemas, total };
     }
@@ -2783,12 +3231,30 @@ function collectExpectedDriftReasons(schemaName, fieldDiffs, expectedDrift) {
 function compareIndexLists(reference, target) {
   const refIndexes = reference.indexList || [];
   const targetIndexes = target.indexList || [];
-  const refKeys = new Set(refIndexes.map((i) => `${i.schema}.${i.name}`));
-  const targetKeys = new Set(targetIndexes.map((i) => `${i.schema}.${i.name}`));
-  const missing = refIndexes.filter((i) => !targetKeys.has(`${i.schema}.${i.name}`));
-  const extra = targetIndexes.filter((i) => !refKeys.has(`${i.schema}.${i.name}`));
+  const buildIndexKey = (index) => [
+    index.schema,
+    index.table,
+    index.isUnique ? "unique" : "nonunique",
+    index.isPartial ? "partial" : "full",
+    normalizeDiffValue(index.whereClause),
+    normalizeDiffValue(index.accessMethod),
+    normalizeIndexDefinition(index.definition)
+  ].join(":");
+  const refKeys = new Set(refIndexes.map(buildIndexKey));
+  const targetKeys = new Set(targetIndexes.map(buildIndexKey));
+  const missing = refIndexes.filter((index) => !targetKeys.has(buildIndexKey(index)));
+  const extra = targetIndexes.filter((index) => !refKeys.has(buildIndexKey(index)));
   return { missing, extra };
 }
+function normalizeDiffValue(value) {
+  return (value ?? "").replace(/\s+/g, " ").trim();
+}
+function normalizeIndexDefinition(value) {
+  return normalizeDiffValue(value).replace(
+    /^create\s+(unique\s+)?index\s+\S+\s+on\s+/i,
+    (_match, unique = "") => `create ${unique || ""}index on `
+  );
+}
 function formatIndexInfo(index) {
   const qualifiedName = `${index.schema}.${index.name}`;
   const tags = [];
@@ -2805,7 +3271,27 @@ function hasIndexDiff(diff) {
 function emptyStats() {
   return {
     schemas: {},
-    total: { tables: 0, functions: 0, policies: 0, indexes: 0, triggers: 0 }
+    total: { tables: 0, functions: 0, policies: 0, indexes: 0, triggers: 0 },
+    available: true
+  };
+}
+function unavailableStats(error) {
+  return {
+    ...emptyStats(),
+    available: false,
+    error,
+    canonicalSnapshot: createUnavailableCanonicalSnapshot(error)
+  };
+}
+function cloneEnvironmentStats(stats) {
+  return {
+    ...stats,
+    schemas: Object.fromEntries(
+      Object.entries(stats.schemas).map(([schema, values]) => [schema, { ...values }])
+    ),
+    total: { ...stats.total },
+    indexList: stats.indexList?.map((index) => ({ ...index })),
+    canonicalSnapshot: stats.canonicalSnapshot
   };
 }
 function logSchemaStats(label, stats, includeSchemas = false) {
@@ -2817,43 +3303,158 @@ function logSchemaStats(label, stats, includeSchemas = false) {
   const schemas = Object.keys(stats.schemas);
   console.log(`${base} (schemas: ${schemas.join(", ")})`);
 }
-function createStatsTask(dbUrl, label, includeSchemas = false) {
+async function collectEnvironmentStats(dbUrl, label, includeSchemas = false) {
   if (!dbUrl) {
-    return Promise.resolve(null);
+    return null;
   }
-  return getDbSchemaStats(dbUrl).then((stats) => {
-    logSchemaStats(label, stats, includeSchemas);
-    return stats;
-  });
+  const stats = await getDbSchemaStats(dbUrl);
+  stats.canonicalSnapshot = await getCanonicalSchemaSnapshot(dbUrl);
+  stats.available = true;
+  logSchemaStats(label, stats, includeSchemas);
+  return stats;
 }
 function resolveSettledStats(result, failureLabel) {
   if (result.status === "fulfilled" && result.value) {
     return result.value;
   }
+  const reason = result.status === "rejected" ? String(result.reason) : `${failureLabel} database URL is not available for schema comparison`;
   if (result.status === "rejected") {
     console.warn(`[schema-stats] Failed to query ${failureLabel} database: ${result.reason}`);
   }
-  return emptyStats();
+  return unavailableStats(reason);
 }
 function resolveSettledProductionStats(result) {
   if (result.status === "fulfilled") {
     return result.value;
   }
   console.warn(`[schema-stats] Failed to query production database: ${result.reason}`);
-  return null;
+  return unavailableStats(String(result.reason));
+}
+function buildAdminDsn(sourceDbUrl) {
+  const conn = parsePostgresUrl(sourceDbUrl);
+  const password = conn.password ? `:${encodeURIComponent(conn.password)}` : "";
+  return `postgresql://${conn.user}${password}@${conn.host}:${conn.port}/postgres`;
+}
+function buildShadowDsn(sourceDbUrl, dbName) {
+  const conn = parsePostgresUrl(sourceDbUrl);
+  const password = conn.password ? `:${encodeURIComponent(conn.password)}` : "";
+  return `postgresql://${conn.user}${password}@${conn.host}:${conn.port}/${dbName}`;
+}
+function createReferenceDb(sourceDbUrl) {
+  const dbName = `ci_schema_ref_${randomUUID().replace(/-/g, "").slice(0, 12)}`;
+  const adminDsn = buildAdminDsn(sourceDbUrl);
+  const createResult = psqlSyncQuery({
+    databaseUrl: adminDsn,
+    sql: `CREATE DATABASE ${dbName}`,
+    timeout: 3e4
+  });
+  if (createResult.status !== 0) {
+    throw new Error(
+      `Failed to create reference database: ${createResult.stderr || createResult.stdout}`
+    );
+  }
+  return { dsn: buildShadowDsn(sourceDbUrl, dbName), dbName };
+}
+function dropReferenceDb(sourceDbUrl, dbName) {
+  const adminDsn = buildAdminDsn(sourceDbUrl);
+  psqlSyncQuery({
+    databaseUrl: adminDsn,
+    sql: `
+      SELECT pg_terminate_backend(pid)
+      FROM pg_stat_activity
+      WHERE datname = '${dbName}' AND pid <> pg_backend_pid()
+    `,
+    timeout: 1e4
+  });
+  psqlSyncQuery({
+    databaseUrl: adminDsn,
+    sql: `DROP DATABASE IF EXISTS ${dbName}`,
+    timeout: 3e4
+  });
+}
+async function buildReferenceStats(repoRoot, tmpDir, sourceDbUrl) {
+  if (!sourceDbUrl) return null;
+  const referenceDb = createReferenceDb(sourceDbUrl);
+  const logFile = path4.join(tmpDir, "ci-reference-db-apply.log");
+  try {
+    const result = await execa(
+      "pnpm",
+      ["exec", "runa", "db", "apply", "preview", "--auto-approve", "--no-seed", "--verbose"],
+      {
+        cwd: repoRoot,
+        env: {
+          ...process.env,
+          DATABASE_URL_ADMIN: referenceDb.dsn,
+          DATABASE_URL: referenceDb.dsn
+        },
+        reject: false
+      }
+    );
+    const fullOutput = `${result.stdout || ""}
+${result.stderr || ""}`;
+    if (result.exitCode !== 0) {
+      throw new Error(`Failed to build reference DB: ${fullOutput.substring(0, 1e3)}`);
+    }
+    await (await import('fs/promises')).writeFile(logFile, fullOutput);
+    return collectEnvironmentStats(referenceDb.dsn, "Reference", true);
+  } finally {
+    dropReferenceDb(sourceDbUrl, referenceDb.dbName);
+  }
+}
+async function resolveReferenceAndCiStats(params) {
+  const { repoRoot, tmpDir, referenceDbUrl, ciDbUrl, referenceStrategy } = params;
+  if (referenceStrategy === "reuse-ci" && ciDbUrl) {
+    console.log(
+      "[schema-stats] Reusing synced CI database as reference schema (skip temporary rebuild)"
+    );
+    const [ciResult2] = await Promise.allSettled([collectEnvironmentStats(ciDbUrl, "CI")]);
+    const ci = resolveSettledStats(ciResult2, "CI");
+    const reference = ci.available === false ? unavailableStats(ci.error ?? "CI database is unavailable for reference schema reuse") : cloneEnvironmentStats(ci);
+    return [reference, ci];
+  }
+  const [referenceResult, ciResult] = await Promise.allSettled([
+    buildReferenceStats(repoRoot, tmpDir, referenceDbUrl),
+    collectEnvironmentStats(ciDbUrl, "CI")
+  ]);
+  return [resolveSettledStats(referenceResult, "reference"), resolveSettledStats(ciResult, "CI")];
 }
 var collectSchemaStatsActor = fromPromise(
   async ({ input }) => {
-    const { localDbUrl, ciDbUrl, queryProduction } = input;
-    console.log("[schema-stats] Collecting schema statistics (DB query mode, parallel)...");
+    const {
+      repoRoot,
+      referenceDbUrl,
+      ciDbUrl,
+      referenceStrategy = "rebuild",
+      queryProduction,
+      tmpDir
+    } = input;
+    console.log(
+      "[schema-stats] Collecting schema statistics (Reference/CI/Production, parallel)..."
+    );
     const productionUrl = process.env.GH_DATABASE_URL_ADMIN || process.env.GH_DATABASE_URL;
-    const [localResult, ciResult, productionResult] = await Promise.allSettled([
-      createStatsTask(localDbUrl, "Local", true),
-      createStatsTask(ciDbUrl, "CI"),
-      createStatsTask(queryProduction ? productionUrl ?? null : null, "Production")
+    const [referenceResult, productionResult] = await Promise.allSettled([
+      resolveReferenceAndCiStats({
+        repoRoot,
+        tmpDir,
+        referenceDbUrl,
+        ciDbUrl,
+        referenceStrategy
+      }),
+      collectEnvironmentStats(queryProduction ? productionUrl ?? null : null, "Production")
     ]);
-    const local = resolveSettledStats(localResult, "local");
-    const ci = resolveSettledStats(ciResult, "CI");
+    let local;
+    let ci;
+    if (referenceResult.status === "fulfilled") {
+      local = referenceResult.value[0];
+      ci = referenceResult.value[1];
+    } else {
+      console.warn(
+        `[schema-stats] Failed to collect reference/CI schema statistics: ${referenceResult.reason}`
+      );
+      const reason = String(referenceResult.reason);
+      local = unavailableStats(reason);
+      ci = unavailableStats(reason);
+    }
     const production = resolveSettledProductionStats(productionResult);
     return {
       schemaStats: {
@@ -3185,24 +3786,27 @@ function extractHazardsWithContext(fullOutput, repoRoot) {
   appendEmojiHazards(fullOutput, idempotentRoles, hazards);
   return hazards;
 }
-function detectNoChanges(fullOutput) {
+function detectSchemaChangeState(fullOutput) {
   const lowerOutput = fullOutput.toLowerCase();
+  const changesIndicators = [
+    "check mode: schema changes detected (not applied)",
+    "schema changes: detected"
+  ];
+  if (changesIndicators.some((indicator) => lowerOutput.includes(indicator))) {
+    return "changes";
+  }
   const noChangesIndicators = [
+    "check mode: all changes are for idempotent-managed objects (nothing to apply)",
+    "schema changes: none",
     "no schema changes detected",
-    // From actors.ts line 969
-    "no schema changes",
-    // Shorter variant
     "already in sync",
-    "nothing to apply",
     "schemas are up to date",
-    "no changes were applied",
-    // From db-apply.ts line 150
-    "no changes",
-    // From actors.ts line 578, 968
-    "in sync"
-    // From db-sync.ts line 80
+    "nothing to apply"
   ];
-  return noChangesIndicators.some((indicator) => lowerOutput.includes(indicator));
+  if (noChangesIndicators.some((indicator) => lowerOutput.includes(indicator))) {
+    return "no-changes";
+  }
+  return "unknown";
 }
 function isCommandSuccess(exitCode, fullOutput) {
   return exitCode === 0 || fullOutput.includes("check complete") || fullOutput.includes("Check Summary");
@@ -3258,6 +3862,39 @@ function buildErrorResult(error, databaseUrl) {
     }
   };
 }
+function buildPreviewFromOutput(fullOutput, repoRoot, productionUrl) {
+  const lines = fullOutput.split("\n");
+  const planSql = extractSqlFromLines(lines) || extractSqlFromSchemaChanges(fullOutput);
+  const hazardDetails = extractHazardsWithContext(fullOutput, repoRoot);
+  const hazards = hazardDetails.map((h) => `${h.type}: ${h.message}`);
+  const schemaChangeState = detectSchemaChangeState(fullOutput);
+  const hasSqlPlan = planSql !== null && planSql.trim().length > 0;
+  const hasHazards = hazards.length > 0;
+  const hasChanges = schemaChangeState === "changes" ? true : schemaChangeState === "no-changes" ? false : hasSqlPlan || hasHazards;
+  const effectivePlanSql = hasChanges ? planSql?.substring(0, 5e3) || null : null;
+  const rawError = extractErrorMessage(fullOutput);
+  return {
+    planSql: effectivePlanSql,
+    hazards,
+    hazardDetails: hazardDetails.length > 0 ? hazardDetails : void 0,
+    hasChanges,
+    error: enhanceConnectionError(rawError, productionUrl)
+  };
+}
+function buildSuccessPreviewResult(exitCode, fullOutput, repoRoot, productionUrl) {
+  const isSuccess = isCommandSuccess(exitCode, fullOutput);
+  const preview = buildPreviewFromOutput(fullOutput, repoRoot, productionUrl);
+  return {
+    preview: {
+      executed: true,
+      planSql: preview.planSql,
+      hazards: preview.hazards,
+      hazardDetails: preview.hazardDetails,
+      hasChanges: preview.hasChanges,
+      error: isSuccess ? null : preview.error
+    }
+  };
+}
 var productionPreviewActor = fromPromise(
   async ({ input }) => {
     const { repoRoot, tmpDir, shouldExecute } = input;
@@ -3282,28 +3919,7 @@ var productionPreviewActor = fromPromise(
       const fullOutput = `${stdout}
 ${stderr}`;
       await writeLogFile(logFile, fullOutput);
-      const lines = fullOutput.split("\n");
-      const planSql = extractSqlFromLines(lines) || extractSqlFromSchemaChanges(fullOutput);
-      const hazardDetails = extractHazardsWithContext(fullOutput, repoRoot);
-      const hazards = hazardDetails.map((h) => `${h.type}: ${h.message}`);
-      const hasNoChangesIndicator = detectNoChanges(fullOutput);
-      const hasSqlPlan = planSql !== null && planSql.trim().length > 0;
-      const hasHazards = hazards.length > 0;
-      const hasChanges = hasNoChangesIndicator ? false : hasSqlPlan || hasHazards;
-      const effectivePlanSql = hasChanges ? planSql?.substring(0, 5e3) || null : null;
-      const isSuccess = isCommandSuccess(result.exitCode, fullOutput);
-      const rawError = !isSuccess ? extractErrorMessage(fullOutput) : null;
-      const errorMessage = rawError ? enhanceConnectionError(rawError, productionUrl) : null;
-      return {
-        preview: {
-          executed: true,
-          planSql: effectivePlanSql,
-          hazards,
-          hazardDetails: hazardDetails.length > 0 ? hazardDetails : void 0,
-          hasChanges,
-          error: errorMessage
-        }
-      };
+      return buildSuccessPreviewResult(result.exitCode, fullOutput, repoRoot, productionUrl);
     } catch (error) {
       return buildErrorResult(error, productionUrl);
     }
@@ -3611,11 +4227,30 @@ function parseSchemaChangeStats(sqlInput, logPath, repoRoot) {
   stats.hazards = parseHazards(sql, idempotentRoles);
   return stats;
 }
-var syncSchemaActor = fromPromise(
-  async ({ input }) => {
-    const { repoRoot, tmpDir, databaseUrl, mode, skipCodegen } = input;
-    const envArg = mode === "ci-local" ? "local" : "preview";
-    const useDbApply = mode !== "ci-local";
+function isCheckSummaryOutput(output) {
+  return output.includes("check complete") || output.includes("Check Summary");
+}
+function isSchemaOutOfSyncOutput(output) {
+  const lowerOutput = output.toLowerCase();
+  return lowerOutput.includes("database schema is out of sync") || lowerOutput.includes("db_schema_out_of_sync");
+}
+function countResidualStatements(stats) {
+  return stats.creates.tables + stats.creates.indexes + stats.creates.policies + stats.creates.functions + stats.creates.other + stats.alters + stats.drops;
+}
+function analyzePostCheckResult(params) {
+  const hasSchemaOutOfSync = isSchemaOutOfSyncOutput(params.output);
+  const hasDrift = hasSchemaOutOfSync || countResidualStatements(params.residualStats) > 0;
+  const checkSucceeded = params.exitCode === 0 || isCheckSummaryOutput(params.output) || hasSchemaOutOfSync;
+  return {
+    hasDrift: hasDrift || params.residualStats.hazards.length > 0,
+    commandFailed: !checkSucceeded
+  };
+}
+var syncSchemaActor = fromPromise(
+  async ({ input }) => {
+    const { repoRoot, tmpDir, databaseUrl, mode, skipCodegen } = input;
+    const envArg = mode === "ci-local" ? "local" : "preview";
+    const useDbApply = mode !== "ci-local";
     const gitDiff = getSchemaGitDiff(repoRoot);
     try {
       const databaseUrlForRuntime = normalizeDatabaseUrlForDdl(databaseUrl);
@@ -3649,7 +4284,18 @@ var syncSchemaActor = fromPromise(
         // Always verbose for full traceability
         ...skipCodegen ? ["--skip-codegen"] : []
       ];
+      const checkArgs = useDbApply ? ["exec", "runa", "db", "apply", envArg, "--check", "--no-seed", "--verbose"] : [
+        "exec",
+        "runa",
+        "db",
+        "sync",
+        envArg,
+        "--check",
+        "--verbose",
+        ...skipCodegen ? ["--skip-codegen"] : []
+      ];
       const logFile = path4.join(tmpDir, `ci-db-${useDbApply ? "apply" : "sync"}-${envArg}.log`);
+      const afterCheckLogFile = path4.join(tmpDir, `ci-db-check-${envArg}.log`);
       await runLogged({
         cwd: repoRoot,
         env: baseEnv,
@@ -3658,23 +4304,54 @@ var syncSchemaActor = fromPromise(
         args: syncArgs,
         logFile
       });
+      const postCheckResult = await runLogged({
+        cwd: repoRoot,
+        env: baseEnv,
+        label: `db ${useDbApply ? "apply" : "sync"} check (${envArg})`,
+        command: "pnpm",
+        args: checkArgs,
+        logFile: afterCheckLogFile,
+        reject: false
+      });
       let logContent = "";
+      let afterCheckLogContent = "";
       try {
         logContent = readFileSync(logFile, "utf-8");
       } catch {
       }
+      try {
+        afterCheckLogContent = readFileSync(afterCheckLogFile, "utf-8");
+      } catch {
+      }
       const changeStats = parseSchemaChangeStats(logContent, null, repoRoot);
+      const residualStats = parseSchemaChangeStats(afterCheckLogContent, null, repoRoot);
+      const fullPostCheckOutput = `${postCheckResult.stdout || ""}
+${postCheckResult.stderr || ""}`;
+      const postCheckAnalysis = analyzePostCheckResult({
+        exitCode: postCheckResult.exitCode ?? 1,
+        output: fullPostCheckOutput,
+        residualStats
+      });
+      if (postCheckAnalysis.commandFailed) {
+        throw new Error(
+          `Schema post-check failed (${postCheckResult.exitCode}): ${fullPostCheckOutput.substring(
+            0,
+            1e3
+          )}`
+        );
+      }
       const schemaDrift = {
         beforeSql: logContent.substring(0, 5e3),
         // Truncate for comment
-        afterSql: null,
-        hasDrift: false,
+        afterSql: postCheckAnalysis.hasDrift ? afterCheckLogContent.substring(0, 5e3) : "",
+        checkExecuted: true,
+        hasDrift: postCheckAnalysis.hasDrift,
         changeStats,
         gitDiff,
         logs: {
           beforeCheckLogPath: logFile,
           applyLogPath: logFile,
-          afterCheckLogPath: logFile
+          afterCheckLogPath: afterCheckLogFile
         }
       };
       return { applied: true, schemaDrift };
@@ -3682,6 +4359,7 @@ var syncSchemaActor = fromPromise(
       const schemaDrift = {
         beforeSql: null,
         afterSql: null,
+        checkExecuted: false,
         hasDrift: false,
         changeStats: null,
         gitDiff,
@@ -4345,6 +5023,213 @@ function safeReadFile(filePath) {
     return null;
   }
 }
+function buildSanitizeState() {
+  return {
+    inSingle: false,
+    inDouble: false,
+    inTemplate: false,
+    inLineComment: false,
+    inBlockComment: false
+  };
+}
+function applySanitizeStep(state, stateUpdate) {
+  return { ...state, ...stateUpdate };
+}
+function processLineCommentState(char) {
+  return {
+    output: char === "\n" ? "\n" : " ",
+    nextIndex: 1,
+    state: {
+      inLineComment: char !== "\n"
+    }
+  };
+}
+function processBlockCommentState(char, next) {
+  if (char === "*" && next === "/") {
+    return {
+      output: "  ",
+      nextIndex: 2,
+      state: { inBlockComment: false }
+    };
+  }
+  return {
+    output: char === "\n" ? "\n" : " ",
+    nextIndex: 1,
+    state: {}
+  };
+}
+function processSingleQuoteState(content, i, stripStrings) {
+  const char = content[i] ?? "";
+  if (char === "\\") {
+    return {
+      output: stripStrings ? "  " : `${char}${content[i + 1] ?? ""}`,
+      nextIndex: 2,
+      state: {}
+    };
+  }
+  if (char === "'") {
+    return {
+      output: char,
+      nextIndex: 1,
+      state: { inSingle: false }
+    };
+  }
+  return {
+    output: stripStrings ? " " : char,
+    nextIndex: 1,
+    state: {}
+  };
+}
+function processDoubleQuoteState(content, i, stripStrings) {
+  const char = content[i] ?? "";
+  if (char === "\\") {
+    return {
+      output: stripStrings ? "  " : `${char}${content[i + 1] ?? ""}`,
+      nextIndex: 2,
+      state: {}
+    };
+  }
+  if (char === '"') {
+    return {
+      output: char,
+      nextIndex: 1,
+      state: { inDouble: false }
+    };
+  }
+  return {
+    output: stripStrings ? " " : char,
+    nextIndex: 1,
+    state: {}
+  };
+}
+function processTemplateQuoteState(content, i, stripStrings) {
+  const char = content[i] ?? "";
+  if (char === "\\") {
+    return {
+      output: stripStrings ? "  " : `${char}${content[i + 1] ?? ""}`,
+      nextIndex: 2,
+      state: {}
+    };
+  }
+  if (char === "`") {
+    return {
+      output: "`",
+      nextIndex: 1,
+      state: { inTemplate: false }
+    };
+  }
+  return {
+    output: stripStrings ? char === "\n" ? "\n" : " " : char,
+    nextIndex: 1,
+    state: {}
+  };
+}
+function processQuoteState(content, i, stripStrings, quote) {
+  if (quote === "'") return processSingleQuoteState(content, i, stripStrings);
+  if (quote === '"') return processDoubleQuoteState(content, i, stripStrings);
+  return processTemplateQuoteState(content, i, stripStrings);
+}
+function processDefaultState(char, next) {
+  if (char === "/" && next === "/") {
+    return {
+      output: "  ",
+      nextIndex: 2,
+      state: { inLineComment: true }
+    };
+  }
+  if (char === "/" && next === "*") {
+    return {
+      output: "  ",
+      nextIndex: 2,
+      state: { inBlockComment: true }
+    };
+  }
+  if (char === "'") {
+    return {
+      output: char,
+      nextIndex: 1,
+      state: { inSingle: true }
+    };
+  }
+  if (char === '"') {
+    return {
+      output: char,
+      nextIndex: 1,
+      state: { inDouble: true }
+    };
+  }
+  if (char === "`") {
+    return {
+      output: char,
+      nextIndex: 1,
+      state: { inTemplate: true }
+    };
+  }
+  return { output: char, nextIndex: 1, state: {} };
+}
+function runSanitizeStep(step, state, result, currentIndex) {
+  return {
+    i: currentIndex + step.nextIndex,
+    result: `${result}${step.output}`,
+    state: applySanitizeStep(state, step.state)
+  };
+}
+function sanitizeTsContent(content, options = {}) {
+  const { stripStrings = false } = options;
+  let result = "";
+  let i = 0;
+  let state = buildSanitizeState();
+  while (i < content.length) {
+    const char = content[i] ?? "";
+    const next = content[i + 1] ?? "";
+    if (state.inLineComment) {
+      const step2 = processLineCommentState(char);
+      const nextState2 = runSanitizeStep(step2, state, result, i);
+      i = nextState2.i;
+      result = nextState2.result;
+      state = nextState2.state;
+      continue;
+    }
+    if (state.inBlockComment) {
+      const step2 = processBlockCommentState(char, next);
+      const nextState2 = runSanitizeStep(step2, state, result, i);
+      i = nextState2.i;
+      result = nextState2.result;
+      state = nextState2.state;
+      continue;
+    }
+    if (state.inSingle) {
+      const step2 = processQuoteState(content, i, stripStrings, "'");
+      const nextState2 = runSanitizeStep(step2, state, result, i);
+      i = nextState2.i;
+      result = nextState2.result;
+      state = nextState2.state;
+      continue;
+    }
+    if (state.inDouble) {
+      const step2 = processQuoteState(content, i, stripStrings, '"');
+      const nextState2 = runSanitizeStep(step2, state, result, i);
+      i = nextState2.i;
+      result = nextState2.result;
+      state = nextState2.state;
+      continue;
+    }
+    if (state.inTemplate) {
+      const step2 = processQuoteState(content, i, stripStrings, "`");
+      const nextState2 = runSanitizeStep(step2, state, result, i);
+      i = nextState2.i;
+      result = nextState2.result;
+      state = nextState2.state;
+      continue;
+    }
+    const step = processDefaultState(char, next);
+    const nextState = runSanitizeStep(step, state, result, i);
+    i = nextState.i;
+    result = nextState.result;
+    state = nextState.state;
+  }
+  return result;
+}
 function readManifest(manifestPath) {
   try {
     if (!existsSync(manifestPath)) {
@@ -4389,11 +5274,12 @@ async function detectLayer1Content(repoRoot, manifest) {
       const filePath = join(repoRoot, file);
       const content = safeReadFile(filePath);
       if (!content) continue;
+      const codeOnly = sanitizeTsContent(content, { stripStrings: true });
       const xstatePatterns = [
         /(?:export\s+)?(?:const|let|var)\s+\w+\s*=\s*createMachine\s*\(/,
         /(?:export\s+)?(?:const|let|var)\s+\w+\s*=\s*setup\s*\([^)]*\)\s*\.createMachine\s*\(/
       ];
-      const hasXStateMachine = xstatePatterns.some((p) => p.test(content));
+      const hasXStateMachine = xstatePatterns.some((p) => p.test(codeOnly));
       if (hasXStateMachine) {
         machineCount++;
       }
@@ -4523,6 +5409,41 @@ async function detectLayer4Content(repoRoot, manifest) {
   }
   return createSkipStatus(base, "No user-facing pages found");
 }
+var detectStaticLayer = async (_repoRoot, _manifest) => ({
+  layer: 0,
+  hasContent: true,
+  contentType: "machines",
+  // Not really, but L0 always runs
+  count: 1,
+  source: "filesystem"
+});
+var layerDetectors = {
+  0: detectStaticLayer,
+  1: detectLayer1Content,
+  2: detectLayer2Content,
+  3: detectLayer3Content,
+  4: detectLayer4Content
+};
+function getUnknownLayerStatus(layer) {
+  return {
+    layer,
+    hasContent: false,
+    contentType: "machines",
+    count: 0,
+    source: "filesystem",
+    skipReason: `Unknown layer ${layer}`
+  };
+}
+async function detectLayerStatus(layer, repoRoot, manifest) {
+  const detector = layerDetectors[layer];
+  if (!detector) {
+    return getUnknownLayerStatus(layer);
+  }
+  if (layer === 0) {
+    return detectStaticLayer();
+  }
+  return detector(repoRoot, manifest);
+}
 async function detectLayerContent(repoRoot, selectedLayers, manifestPath) {
   const effectiveManifestPath = join(repoRoot, ".runa/manifests/manifest.json");
   const manifest = readManifest(effectiveManifestPath);
@@ -4530,40 +5451,7 @@ async function detectLayerContent(repoRoot, selectedLayers, manifestPath) {
   const skippedLayers = [];
   const runnableLayers = [];
   for (const layer of selectedLayers) {
-    let status;
-    switch (layer) {
-      case 0:
-        status = {
-          layer: 0,
-          hasContent: true,
-          contentType: "machines",
-          // Not really, but L0 always runs
-          count: 1,
-          source: "filesystem"
-        };
-        break;
-      case 1:
-        status = await detectLayer1Content(repoRoot, manifest);
-        break;
-      case 2:
-        status = await detectLayer2Content(repoRoot);
-        break;
-      case 3:
-        status = await detectLayer3Content(repoRoot, manifest);
-        break;
-      case 4:
-        status = await detectLayer4Content(repoRoot, manifest);
-        break;
-      default:
-        status = {
-          layer,
-          hasContent: false,
-          contentType: "machines",
-          count: 0,
-          source: "filesystem",
-          skipReason: `Unknown layer ${layer}`
-        };
-    }
+    const status = await detectLayerStatus(layer, repoRoot, manifest);
     layers[layer] = status;
     if (status.hasContent) {
       runnableLayers.push(layer);
@@ -4983,6 +5871,9 @@ function getLayersForCorePhase(selectedLayers, mode) {
 function hasE2ELayer(selectedLayers) {
   return selectedLayers.includes(E2E_LAYER);
 }
+function shouldReuseCiReferenceStats(context) {
+  return context.mode !== "ci-local" && context.schemaApplied && context.schemaDrift !== null && context.schemaDrift?.hasDrift === false;
+}
 function mergeLayerResults(coreResults, e2eResults) {
   return { ...coreResults, ...e2eResults };
 }
@@ -5079,7 +5970,7 @@ init_esm_shims();
 var CI_STEPS = [
   { step: "setup", label: "\u74B0\u5883\u30BB\u30C3\u30C8\u30A2\u30C3\u30D7", detail: "\u30EA\u30DD\u30B8\u30C8\u30EA\u691C\u51FA\u3001Supabase\u8D77\u52D5" },
   { step: "syncSchema", label: "\u30B9\u30AD\u30FC\u30DE\u540C\u671F", detail: "pg-schema-diff \u2192 CI DB" },
-  { step: "applySeeds", label: "\u30B7\u30FC\u30C9\u9069\u7528", detail: "ci.sql + pgTAP + roles" },
+  { step: "applySeeds", label: "\u30B7\u30FC\u30C9\u9069\u7528", detail: "ci.sql + prerequisite seeds" },
   { step: "staticChecks", label: "\u9759\u7684\u30C1\u30A7\u30C3\u30AF", detail: "\u578B\u30C1\u30A7\u30C3\u30AF \u2225 lint" },
   { step: "build", label: "\u30D3\u30EB\u30C9", detail: "build \u2225 playwright install" },
   { step: "runTests", label: "\u30C6\u30B9\u30C8\u5B9F\u884C", detail: "L0-L3 (\u30D6\u30ED\u30C3\u30AD\u30F3\u30B0) \u2192 L4 (E2E)" },
@@ -5243,43 +6134,187 @@ function formatSkippedLayers(layerSkipReasons, originalSelectedLayers) {
   return lines;
 }
 
-// src/commands/ci/machine/formatters/sections/schema-matrix.ts
+// src/commands/ci/machine/formatters/sections/production-schema-status.ts
 init_esm_shims();
+var COUNT_FIELDS = [
+  "tables",
+  "functions",
+  "policies",
+  "indexes",
+  "triggers"
+];
 function emptyStats2() {
   return { tables: 0, functions: 0, policies: 0, indexes: 0, triggers: 0 };
 }
-function formatLocalCell(stats) {
+function findExpectedCountDrift(schemaName, field, expectedDrift) {
+  return expectedDrift.find(
+    (entry) => entry.field === field && (entry.schemas === void 0 || entry.schemas.includes(schemaName))
+  ) ?? null;
+}
+function buildCountDiffs(schemaStats, expectedDrift) {
+  if (!schemaStats?.local || !schemaStats.production) return [];
+  if (schemaStats.local.available === false || schemaStats.production.available === false) {
+    return [];
+  }
+  const schemaNames = /* @__PURE__ */ new Set([
+    ...Object.keys(schemaStats.local.schemas),
+    ...Object.keys(schemaStats.production.schemas)
+  ]);
+  const diffs = [];
+  for (const schemaName of Array.from(schemaNames).sort()) {
+    const reference = schemaStats.local.schemas[schemaName] ?? emptyStats2();
+    const production = schemaStats.production.schemas[schemaName] ?? emptyStats2();
+    for (const field of COUNT_FIELDS) {
+      if (reference[field] === production[field]) continue;
+      const expected = findExpectedCountDrift(schemaName, field, expectedDrift);
+      diffs.push({
+        schema: schemaName,
+        field,
+        value: production[field],
+        reference: reference[field],
+        delta: production[field] - reference[field],
+        expected: expected !== null,
+        reason: expected?.reason
+      });
+    }
+  }
+  return diffs;
+}
+function areIndexDiffsCoveredByExpectedDrift(indexDiff, countDiffs) {
+  if (!indexDiff || !hasIndexDiff(indexDiff)) return false;
+  const touchedSchemas = /* @__PURE__ */ new Set([
+    ...indexDiff.missing.map((index) => index.schema),
+    ...indexDiff.extra.map((index) => index.schema)
+  ]);
+  if (touchedSchemas.size === 0) return false;
+  const expectedIndexSchemas = new Set(
+    countDiffs.filter((diff) => diff.field === "indexes" && diff.expected).map((diff) => diff.schema)
+  );
+  const unexpectedIndexSchemas = new Set(
+    countDiffs.filter((diff) => diff.field === "indexes" && !diff.expected).map((diff) => diff.schema)
+  );
+  for (const schema of touchedSchemas) {
+    if (unexpectedIndexSchemas.has(schema)) return false;
+    if (!expectedIndexSchemas.has(schema)) return false;
+  }
+  return true;
+}
+function buildIndexDiff(schemaStats) {
+  if (!schemaStats?.local || !schemaStats.production) return null;
+  if (schemaStats.local.available === false || schemaStats.production.available === false) {
+    return null;
+  }
+  return compareIndexLists(schemaStats.local, schemaStats.production);
+}
+function buildSemanticDiff(schemaStats) {
+  const referenceSnapshot = schemaStats?.local?.canonicalSnapshot;
+  const productionSnapshot = schemaStats?.production?.canonicalSnapshot;
+  if (!referenceSnapshot || !productionSnapshot) return null;
+  if (referenceSnapshot.available !== true || productionSnapshot.available !== true) return null;
+  return compareCanonicalSnapshots(referenceSnapshot, productionSnapshot);
+}
+function getProductionSchemaSignals(productionPreview, schemaStats, expectedDrift = []) {
+  const previewHasChanges = productionPreview?.hasChanges === true;
+  const indexDiff = buildIndexDiff(schemaStats);
+  const semanticDiff = buildSemanticDiff(schemaStats);
+  const countDiffs = buildCountDiffs(schemaStats, expectedDrift);
+  const hasIndexChanges = indexDiff ? hasIndexDiff(indexDiff) : false;
+  const hasUnexpectedIndexChanges = hasIndexChanges && !areIndexDiffsCoveredByExpectedDrift(indexDiff, countDiffs);
+  const hasSemanticChanges = semanticDiff ? hasCanonicalChanges(semanticDiff) : false;
+  const hasCountChanges = countDiffs.length > 0;
+  const hasUnexpectedCountChanges = countDiffs.some((diff) => !diff.expected);
+  const knownDriftReasons = Array.from(
+    new Set(countDiffs.filter((diff) => diff.expected).flatMap((diff) => diff.reason ?? []))
+  );
+  const hasKnownDriftOnly = hasCountChanges && !previewHasChanges && !hasUnexpectedCountChanges && !hasUnexpectedIndexChanges && !hasSemanticChanges;
+  const requiresDeploy = previewHasChanges || hasUnexpectedIndexChanges || hasSemanticChanges || hasUnexpectedCountChanges;
+  return {
+    previewHasChanges,
+    indexDiff,
+    semanticDiff,
+    countDiffs,
+    hasIndexChanges,
+    hasUnexpectedIndexChanges,
+    hasSemanticChanges,
+    hasCountChanges,
+    hasUnexpectedCountChanges,
+    hasKnownDriftOnly,
+    knownDriftReasons,
+    requiresDeploy,
+    previewMissedChanges: !previewHasChanges && (hasUnexpectedIndexChanges || hasSemanticChanges || hasUnexpectedCountChanges),
+    previewOnlyChanges: previewHasChanges && !hasUnexpectedIndexChanges && !hasSemanticChanges && !hasUnexpectedCountChanges
+  };
+}
+
+// src/commands/ci/machine/formatters/sections/schema-matrix.ts
+init_esm_shims();
+function emptyStats3() {
+  return { tables: 0, functions: 0, policies: 0, indexes: 0, triggers: 0 };
+}
+function isStatsAvailable(stats) {
+  return stats != null && stats.available !== false;
+}
+function isSemanticSnapshotAvailable(stats) {
+  return stats != null && stats.available !== false && stats.canonicalSnapshot?.available === true;
+}
+function formatUnavailableCell(stats) {
+  if (stats == null) return "n/a";
+  return stats.error ? `\u26AA unavailable` : "n/a";
+}
+function formatReferenceCell(stats, isAvailable) {
+  if (!isAvailable) return "\u26AA unavailable";
   return formatSchemaStatsCompact(stats, true);
 }
-function formatCiCellWithDiff(stats, reference) {
-  if (hasDisplayedStatsDiff(stats, reference)) {
+function formatCiCellWithDiff(stats, reference, semanticSummary, isAvailable, referenceAvailable) {
+  if (!isAvailable) return "\u26AA unavailable";
+  if (!referenceAvailable) return formatSchemaStatsCompact(stats, true);
+  if (hasDisplayedStatsDiff(stats, reference) || semanticSummary?.hasChanges) {
     return `\u26A0\uFE0F ${formatSchemaStatsWithDiff(stats, reference)}`;
   }
   return formatSchemaStatsCompact(stats, true);
 }
-function formatProdCellWithDiff(stats, reference, schemaName, expectedDrift) {
-  if (!hasDisplayedStatsDiff(stats, reference)) {
+function formatProdCellWithDiff(stats, reference, schemaName, expectedDrift, semanticSummary, isAvailable, referenceAvailable) {
+  if (!isAvailable) return "\u26AA unavailable";
+  if (!referenceAvailable) return formatSchemaStatsCompact(stats, true);
+  if (!hasDisplayedStatsDiff(stats, reference) && !semanticSummary?.hasChanges) {
     return formatSchemaStatsCompact(stats, true);
   }
   const fieldDiffs = getFieldDiffs(stats, reference);
-  const allExpected = expectedDrift.length > 0 && isAllDriftExpected(schemaName, fieldDiffs, expectedDrift);
+  const allExpected = !semanticSummary?.hasChanges && expectedDrift.length > 0 && isAllDriftExpected(schemaName, fieldDiffs, expectedDrift);
   const marker = allExpected ? "\u{1F4CB}" : "\u{1F4DD}";
   return `${marker} ${formatSchemaStatsWithDiff(stats, reference)}`;
 }
-function formatCiTotalCellWithDiff(stats, reference) {
+function formatCiTotalCellWithDiff(stats, reference, hasSemanticChanges, isAvailable, referenceAvailable) {
+  if (!isAvailable) return "**\u26AA unavailable**";
+  if (!referenceAvailable) return `**${formatSchemaStatsCompact(stats, true)}**`;
   const formatted = formatSchemaStatsCompact(stats, true);
-  if (hasDisplayedStatsDiff(stats, reference)) {
+  if (hasDisplayedStatsDiff(stats, reference) || hasSemanticChanges) {
     return `\u26A0\uFE0F **${formatted}**`;
   }
   return `**${formatted}**`;
 }
-function formatProdTotalCellWithDiff(stats, reference) {
+function formatProdTotalCellWithDiff(stats, reference, hasSemanticChanges, isAvailable, referenceAvailable) {
+  if (!isAvailable) return "**\u26AA unavailable**";
+  if (!referenceAvailable) return `**${formatSchemaStatsCompact(stats, true)}**`;
   const formatted = formatSchemaStatsCompact(stats, true);
-  if (hasDisplayedStatsDiff(stats, reference)) {
+  if (hasDisplayedStatsDiff(stats, reference) || hasSemanticChanges) {
     return `\u{1F4DD} **${formatted}**`;
   }
   return `**${formatted}**`;
 }
+function buildCanonicalDiffs(schemaStats) {
+  const referenceSnapshot = schemaStats.local.canonicalSnapshot;
+  const ciSnapshot = schemaStats.ci.canonicalSnapshot;
+  const productionSnapshot = schemaStats.production?.canonicalSnapshot;
+  const ciDiff = isSemanticSnapshotAvailable(schemaStats.local) && isSemanticSnapshotAvailable(schemaStats.ci) ? compareCanonicalSnapshots(referenceSnapshot, ciSnapshot) : null;
+  const productionDiff = isSemanticSnapshotAvailable(schemaStats.local) && isSemanticSnapshotAvailable(schemaStats.production) ? compareCanonicalSnapshots(referenceSnapshot, productionSnapshot) : null;
+  return {
+    ci: ciDiff,
+    production: productionDiff,
+    ciBySchema: ciDiff ? summarizeCanonicalDiffBySchema(ciDiff) : {},
+    productionBySchema: productionDiff ? summarizeCanonicalDiffBySchema(productionDiff) : {}
+  };
+}
 function getSortedActiveSchemas(schemaStats) {
   const allSchemas = /* @__PURE__ */ new Set([
     ...getActiveSchemas(schemaStats.local),
@@ -5292,37 +6327,67 @@ function getSortedActiveSchemas(schemaStats) {
     return a.localeCompare(b);
   });
 }
-function generateSchemaTableRows(schemaStats, sortedSchemas, hasProduction, expectedDrift) {
+function generateSchemaTableRows(schemaStats, sortedSchemas, hasProduction, expectedDrift, ciDiffBySchema, productionDiffBySchema) {
   const lines = [];
   for (const schemaName of sortedSchemas) {
-    const localStats = schemaStats.local.schemas[schemaName] ?? emptyStats2();
-    const ciStats = schemaStats.ci.schemas[schemaName] ?? emptyStats2();
+    const localStats = schemaStats.local.schemas[schemaName] ?? emptyStats3();
+    const ciStats = schemaStats.ci.schemas[schemaName] ?? emptyStats3();
     const prodStats = schemaStats.production?.schemas[schemaName] ?? null;
-    const localCell = formatLocalCell(localStats);
-    const ciCell = formatCiCellWithDiff(ciStats, localStats);
-    const prodCell = prodStats !== null ? formatProdCellWithDiff(prodStats, localStats, schemaName, expectedDrift) : null;
+    const localCell = formatReferenceCell(localStats, isStatsAvailable(schemaStats.local));
+    const ciCell = formatCiCellWithDiff(
+      ciStats,
+      localStats,
+      ciDiffBySchema[schemaName],
+      isStatsAvailable(schemaStats.ci),
+      isStatsAvailable(schemaStats.local)
+    );
+    const prodCell = prodStats !== null ? formatProdCellWithDiff(
+      prodStats,
+      localStats,
+      schemaName,
+      expectedDrift,
+      productionDiffBySchema[schemaName],
+      isStatsAvailable(schemaStats.production),
+      isStatsAvailable(schemaStats.local)
+    ) : formatUnavailableCell(schemaStats.production);
     lines.push(
       hasProduction ? `| ${schemaName} | ${localCell} | ${ciCell} | ${prodCell ?? "n/a"} |` : `| ${schemaName} | ${localCell} | ${ciCell} |`
     );
   }
   return lines;
 }
-function generateSchemaMatrixSummary(localTotal, ciTotal, prodTotal) {
-  const ciSynced = !hasDisplayedStatsDiff(localTotal, ciTotal);
-  const prodSynced = prodTotal === null || !hasDisplayedStatsDiff(localTotal, prodTotal);
-  if (ciSynced && prodSynced) {
-    return `\u{1F4CA} **Local:** ${formatTotalStatsCompact(localTotal)}`;
+function generateSchemaMatrixSummary(localTotal, ciTotal, prodTotal, hasCiSemanticDiff, hasProdSemanticDiff, localAvailable, ciAvailable, prodAvailable) {
+  if (!localAvailable) {
+    const parts2 = ["\u{1F4CA} **Reference:** unavailable"];
+    if (ciAvailable) parts2.push(`| **CI:** ${formatTotalStatsCompact(ciTotal)}`);
+    else parts2.push("| **CI:** unavailable");
+    if (prodTotal !== null) {
+      parts2.push(
+        prodAvailable ? `| **Prod:** ${formatTotalStatsCompact(prodTotal)}` : "| **Prod:** unavailable"
+      );
+    }
+    return parts2.join(" ");
+  }
+  const ciSynced = ciAvailable && !hasDisplayedStatsDiff(localTotal, ciTotal) && !hasCiSemanticDiff;
+  const prodSynced = prodTotal === null || prodAvailable && !hasDisplayedStatsDiff(localTotal, prodTotal) && !hasProdSemanticDiff;
+  if (ciSynced && prodSynced && ciAvailable && (prodTotal === null || prodAvailable)) {
+    return `\u{1F4CA} **Reference:** ${formatTotalStatsCompact(localTotal)}`;
   }
-  const parts = [`\u{1F4CA} **Local:** ${formatTotalStatsCompact(localTotal)}`];
-  if (!ciSynced) parts.push(`| **CI:** ${formatTotalStatsCompact(ciTotal)}`);
+  const parts = [`\u{1F4CA} **Reference:** ${formatTotalStatsCompact(localTotal)}`];
+  if (!ciAvailable) parts.push("| **CI:** unavailable");
+  else if (!ciSynced) parts.push(`| **CI:** ${formatTotalStatsCompact(ciTotal)}`);
   if (prodTotal !== null && !prodSynced) {
-    parts.push(`| **Prod:** \u{1F4DD} ${formatTotalStatsCompact(prodTotal)}`);
+    parts.push(
+      prodAvailable ? `| **Prod:** \u{1F4DD} ${formatTotalStatsCompact(prodTotal)}` : "| **Prod:** unavailable"
+    );
   }
   return parts.join(" ");
 }
 function generateIndexDiffSection(schemaStats) {
-  if (!schemaStats.production) return [];
-  const diff = compareIndexLists(schemaStats.local, schemaStats.production);
+  if (!isStatsAvailable(schemaStats.local) || !isStatsAvailable(schemaStats.production)) return [];
+  const productionStats = schemaStats.production;
+  if (!productionStats) return [];
+  const diff = compareIndexLists(schemaStats.local, productionStats);
   if (!hasIndexDiff(diff)) return [];
   const lines = [];
   if (diff.missing.length > 0) {
@@ -5342,11 +6407,88 @@ function generateIndexDiffSection(schemaStats) {
   }
   return lines;
 }
+function appendAvailabilityNote(lines, label, error, kind) {
+  const scope = kind === "stats" ? "schema stats" : "semantic diff";
+  lines.push(`> \u26AA **${label} ${scope} unavailable:** ${error ?? "unknown error"}`);
+}
+function generateAvailabilityNotes(schemaStats) {
+  const lines = [];
+  const appendNotesForEnv = (label, stats) => {
+    if (stats == null) return;
+    if (!isStatsAvailable(stats)) {
+      appendAvailabilityNote(lines, label, stats.error, "stats");
+      return;
+    }
+    if (stats.canonicalSnapshot?.available === false) {
+      appendAvailabilityNote(lines, label, stats.canonicalSnapshot.error, "semantic");
+    }
+  };
+  appendNotesForEnv("Reference", schemaStats.local);
+  appendNotesForEnv("CI", schemaStats.ci);
+  appendNotesForEnv("Prod", schemaStats.production);
+  if (lines.length === 0) return [];
+  return ["", ...lines, ">"];
+}
+function describeObject(object) {
+  switch (object.kind) {
+    case "index":
+      return `index \`${object.label}\``;
+    case "policy":
+      return `policy \`${object.label}\``;
+    case "trigger":
+      return `trigger \`${object.label}\``;
+    case "function":
+      return `function \`${object.label}\``;
+    case "table":
+      return `table \`${object.label}\``;
+  }
+}
+function appendObjectLines(lines, prefix, objects, label) {
+  if (objects.length === 0) return;
+  lines.push(`> ${prefix} **${label}:**`);
+  for (const object of objects.slice(0, 6)) {
+    lines.push(`> - ${describeObject(object)}`);
+  }
+  if (objects.length > 6) {
+    lines.push(`> - ... \u4ED6${objects.length - 6}\u4EF6`);
+  }
+  lines.push(">");
+}
+function appendChangedObjectLines(lines, prefix, pairs, label) {
+  if (pairs.length === 0) return;
+  lines.push(`> ${prefix} **${label}:**`);
+  for (const pair of pairs.slice(0, 6)) {
+    lines.push(`> - ${describeObject(pair.reference)}`);
+  }
+  if (pairs.length > 6) {
+    lines.push(`> - ... \u4ED6${pairs.length - 6}\u4EF6`);
+  }
+  lines.push(">");
+}
+function generateSemanticDiffSection(title, prefix, diff) {
+  if (!diff || !hasCanonicalChanges(diff)) return [];
+  const lines = ["", `> ${prefix} **${title} semantic diff:**`, ">"];
+  appendObjectLines(lines, prefix, diff.missing, "missing objects");
+  appendObjectLines(lines, prefix, diff.extra, "extra objects");
+  appendChangedObjectLines(lines, prefix, diff.changed, "changed objects");
+  if (diff.renamed.length > 0) {
+    lines.push(`> ${prefix} **renamed indexes:**`);
+    for (const pair of diff.renamed.slice(0, 6)) {
+      lines.push(`> - \`${pair.reference.label}\` -> \`${pair.target.label}\``);
+    }
+    if (diff.renamed.length > 6) {
+      lines.push(`> - ... \u4ED6${diff.renamed.length - 6}\u4EF6`);
+    }
+    lines.push(">");
+  }
+  return lines;
+}
 function generateExpectedDriftFootnotes(schemaStats, sortedSchemas, expectedDrift) {
   if (expectedDrift.length === 0 || !schemaStats.production) return [];
+  if (!isStatsAvailable(schemaStats.local) || !isStatsAvailable(schemaStats.production)) return [];
   const allReasons = /* @__PURE__ */ new Set();
   for (const schemaName of sortedSchemas) {
-    const localStats = schemaStats.local.schemas[schemaName] ?? emptyStats2();
+    const localStats = schemaStats.local.schemas[schemaName] ?? emptyStats3();
     const prodStats = schemaStats.production.schemas[schemaName];
     if (!prodStats || !hasDisplayedStatsDiff(prodStats, localStats)) continue;
     const fieldDiffs = getFieldDiffs(prodStats, localStats);
@@ -5370,33 +6512,69 @@ function formatSchemaMatrix(schemaStats, gitDiff, expectedDrift = []) {
   const hasGitChanges = gitDiff && gitDiff.filesChanged.length > 0;
   const header = hasGitChanges ? `### \u30B9\u30AD\u30FC\u30DE\u72B6\u6CC1 (+${gitDiff.linesAdded}/-${gitDiff.linesDeleted} PR\u5185)` : "### \u30B9\u30AD\u30FC\u30DE\u72B6\u6CC1";
   const sortedSchemas = getSortedActiveSchemas(schemaStats);
+  const availabilityNotes = generateAvailabilityNotes(schemaStats);
   if (sortedSchemas.length === 0) {
-    return [header, "", "_\u30B9\u30AD\u30FC\u30DE\u30AA\u30D6\u30B8\u30A7\u30AF\u30C8\u304C\u3042\u308A\u307E\u305B\u3093_", ""];
+    return [header, "", ...availabilityNotes, "_\u30B9\u30AD\u30FC\u30DE\u30AA\u30D6\u30B8\u30A7\u30AF\u30C8\u304C\u3042\u308A\u307E\u305B\u3093_", ""];
   }
   const hasProduction = schemaStats.production !== null;
-  const tableHeader = hasProduction ? ["| Schema | \u{1F4C4} Local | \u{1F52C} CI | \u{1F3ED} Prod |", "|--------|:--------:|:-----:|:-------:|"] : ["| Schema | \u{1F4C4} Local | \u{1F52C} CI |", "|--------|:--------:|:-----:|"];
-  const rows = generateSchemaTableRows(schemaStats, sortedSchemas, hasProduction, expectedDrift);
+  const canonicalDiffs = buildCanonicalDiffs(schemaStats);
+  const tableHeader = hasProduction ? ["| Schema | \u{1F4C4} Reference | \u{1F52C} CI | \u{1F3ED} Prod |", "|--------|:------------:|:-----:|:-------:|"] : ["| Schema | \u{1F4C4} Reference | \u{1F52C} CI |", "|--------|:------------:|:-----:|"];
+  const rows = generateSchemaTableRows(
+    schemaStats,
+    sortedSchemas,
+    hasProduction,
+    expectedDrift,
+    canonicalDiffs.ciBySchema,
+    canonicalDiffs.productionBySchema
+  );
   const { local, ci, production } = schemaStats;
-  const localTotalCell = `**${formatSchemaStatsCompact(local.total, true)}**`;
-  const ciTotalCell = formatCiTotalCellWithDiff(ci.total, local.total);
-  const prodTotalCell = production ? formatProdTotalCellWithDiff(production.total, local.total) : null;
+  const localTotalCell = isStatsAvailable(local) ? `**${formatSchemaStatsCompact(local.total, true)}**` : "**\u26AA unavailable**";
+  const ciTotalCell = formatCiTotalCellWithDiff(
+    ci.total,
+    local.total,
+    canonicalDiffs.ci ? hasCanonicalChanges(canonicalDiffs.ci) : false,
+    isStatsAvailable(ci),
+    isStatsAvailable(local)
+  );
+  const prodTotalCell = production ? formatProdTotalCellWithDiff(
+    production.total,
+    local.total,
+    canonicalDiffs.production ? hasCanonicalChanges(canonicalDiffs.production) : false,
+    isStatsAvailable(production),
+    isStatsAvailable(local)
+  ) : null;
   const totalRow = hasProduction ? `| **Total** | ${localTotalCell} | ${ciTotalCell} | ${prodTotalCell ?? "n/a"} |` : `| **Total** | ${localTotalCell} | ${ciTotalCell} |`;
-  const summary = generateSchemaMatrixSummary(local.total, ci.total, production?.total ?? null);
+  const summary = generateSchemaMatrixSummary(
+    local.total,
+    ci.total,
+    production?.total ?? null,
+    canonicalDiffs.ci ? hasCanonicalChanges(canonicalDiffs.ci) : false,
+    canonicalDiffs.production ? hasCanonicalChanges(canonicalDiffs.production) : false,
+    isStatsAvailable(local),
+    isStatsAvailable(ci),
+    isStatsAvailable(production)
+  );
   const indexDiffSection = generateIndexDiffSection(schemaStats);
   const expectedDriftNotes = generateExpectedDriftFootnotes(
     schemaStats,
     sortedSchemas,
     expectedDrift
   );
+  const semanticDiffSection = [
+    ...generateSemanticDiffSection("CI", "\u26A0\uFE0F", canonicalDiffs.ci),
+    ...generateSemanticDiffSection("Prod", "\u{1F4DD}", canonicalDiffs.production)
+  ];
   return [
     header,
     "",
+    ...availabilityNotes,
     ...tableHeader,
     ...rows,
     totalRow,
     "",
     summary,
     ...indexDiffSection,
+    ...semanticDiffSection,
     ...expectedDriftNotes,
     "",
     "<sub>T=\u30C6\u30FC\u30D6\u30EB F=\u95A2\u6570 P=\u30DD\u30EA\u30B7\u30FC I=\u30A4\u30F3\u30C7\u30C3\u30AF\u30B9 Tr=\u30C8\u30EA\u30AC\u30FC</sub>",
@@ -5406,8 +6584,8 @@ function formatSchemaMatrix(schemaStats, gitDiff, expectedDrift = []) {
 
 // src/commands/ci/machine/formatters/sections/final-comment.ts
 function formatDriftStatus(drift) {
-  if (drift == null) {
-    return "_n/a_";
+  if (drift == null || !drift.checkExecuted) {
+    return "_\u672A\u691C\u8A3C_";
   }
   return drift.hasDrift ? "**\u274C \u30C9\u30EA\u30D5\u30C8\u691C\u51FA (schemas \u2194 CI DB)**" : "**\u2705 \u30C9\u30EA\u30D5\u30C8\u306A\u3057 (schemas \u2194 CI DB)**";
 }
@@ -5532,21 +6710,6 @@ function classifyPreviewError(error) {
   }
   return { label: "\u672C\u756A\u30D7\u30EC\u30D3\u30E5\u30FC\u5931\u6557", guidance: "" };
 }
-function generateIndexDiffWarning(schemaStats) {
-  if (!schemaStats?.local || !schemaStats?.production) return [];
-  const indexDiff = compareIndexLists(schemaStats.local, schemaStats.production);
-  if (!hasIndexDiff(indexDiff)) return [];
-  const diffParts = [];
-  if (indexDiff.missing.length > 0) diffParts.push(`${indexDiff.missing.length}\u4EF6\u4E0D\u8DB3`);
-  if (indexDiff.extra.length > 0) diffParts.push(`${indexDiff.extra.length}\u4EF6\u4F59\u5206`);
-  return [
-    `> \u26A0\uFE0F **\u30A4\u30F3\u30C7\u30C3\u30AF\u30B9\u5DEE\u5206\u691C\u51FA** (${diffParts.join(", ")})`,
-    ">",
-    "> pg-schema-diff \u3067\u306F\u691C\u51FA\u3055\u308C\u307E\u305B\u3093\u3067\u3057\u305F\u304C\u3001\u30A4\u30F3\u30C7\u30C3\u30AF\u30B9\u306E\u5DEE\u5206\u304C\u3042\u308A\u307E\u3059\u3002",
-    "> \u30B9\u30AD\u30FC\u30DE\u30DE\u30C8\u30EA\u30C3\u30AF\u30B9\u306E\u8A73\u7D30\u3092\u78BA\u8A8D\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
-    ""
-  ];
-}
 function generatePreviewError(error) {
   const { label, guidance } = classifyPreviewError(error);
   const lines = [`> \u26A0\uFE0F **${label}**`];
@@ -5567,7 +6730,82 @@ function generatePreviewError(error) {
   );
   return lines;
 }
-function generateProductionPreviewSection(prodPreview, schemaDrift, schemaStats) {
+function generatePreviewChangesDetectedSection(prodPreview, previewOnlyChanges) {
+  const lines = [
+    "> \u{1F536} **\u30B9\u30AD\u30FC\u30DE\u5909\u66F4\u691C\u51FA - \u672C\u756A\u30C7\u30D7\u30ED\u30A4\u304C\u5FC5\u8981\u3067\u3059**",
+    ">",
+    "> \u3053\u306EPR\u3092\u30DE\u30FC\u30B8\u3057\u305F\u5F8C\u3001\u672C\u756A\u30C7\u30D7\u30ED\u30A4\u30EF\u30FC\u30AF\u30D5\u30ED\u30FC\u3092\u5B9F\u884C\u3057\u3066\u30B9\u30AD\u30FC\u30DE\u5909\u66F4\u3092\u9069\u7528\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+    ""
+  ];
+  if (previewOnlyChanges) {
+    lines.push(
+      "> \u88DC\u8DB3: `Prod semantic diff` / count diff / index diff \u3067\u306F\u5DEE\u5206\u304C\u306A\u304F\u3001`production --check` \u306E\u307F\u304C\u5909\u66F4\u3092\u691C\u51FA\u3057\u307E\u3057\u305F\u3002",
+      "> \u3053\u308C\u306F grants / ACL / ownership \u306A\u3069 canonical semantic diff \u306E\u5BFE\u8C61\u5916\u5DEE\u5206\u3067\u3042\u308B\u53EF\u80FD\u6027\u304C\u3042\u308A\u307E\u3059\u3002",
+      ""
+    );
+  }
+  if (prodPreview.planSql) {
+    lines.push(...generatePreviewDetails(prodPreview));
+  }
+  return lines;
+}
+function buildComparisonMismatchReasons(schemaStats, expectedDrift) {
+  const signals = getProductionSchemaSignals(null, schemaStats, expectedDrift);
+  const reasons = [];
+  if (signals.hasSemanticChanges && signals.semanticDiff) {
+    const diff = signals.semanticDiff;
+    reasons.push(
+      `semantic diff: changed ${diff.changed.length}, missing ${diff.missing.length}, extra ${diff.extra.length}, renamed ${diff.renamed.length}`
+    );
+  }
+  if (signals.hasIndexChanges && signals.indexDiff) {
+    reasons.push(
+      `index diff: missing ${signals.indexDiff.missing.length}, extra ${signals.indexDiff.extra.length}`
+    );
+  }
+  if (signals.hasUnexpectedCountChanges) {
+    const unexpectedDiffs = signals.countDiffs.filter((diff) => !diff.expected);
+    const formatted = unexpectedDiffs.slice(0, 6).map(
+      (diff) => `${diff.schema}.${diff.field} ${diff.reference} -> ${diff.value} (${diff.delta >= 0 ? "+" : ""}${diff.delta})`
+    );
+    reasons.push(`count diff: ${formatted.join(", ")}${unexpectedDiffs.length > 6 ? ", ..." : ""}`);
+  }
+  return reasons;
+}
+function generateComparisonMismatchSection(schemaStats, expectedDrift) {
+  const reasons = buildComparisonMismatchReasons(schemaStats, expectedDrift);
+  const lines = [
+    "> \u{1F536} **\u672C\u756ADB\u3068\u306E\u5DEE\u5206\u691C\u51FA - \u672C\u756A\u30C7\u30D7\u30ED\u30A4\u304C\u5FC5\u8981\u3067\u3059**",
+    ">",
+    "> `runa db apply production --check` \u306F\u5909\u66F4\u306A\u3057\u5224\u5B9A\u3067\u3057\u305F\u304C\u3001Reference \u2194 Prod \u306E\u6BD4\u8F03\u3067\u5DEE\u5206\u3092\u691C\u51FA\u3057\u307E\u3057\u305F\u3002",
+    "> \u30B9\u30AD\u30FC\u30DE\u30DE\u30C8\u30EA\u30C3\u30AF\u30B9\u306E `Prod semantic diff` \u3068\u8A73\u7D30\u30ED\u30B0\u3092\u78BA\u8A8D\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+    ""
+  ];
+  for (const reason of reasons) {
+    lines.push(`> - ${reason}`);
+  }
+  if (reasons.length > 0) {
+    lines.push("");
+  }
+  return lines;
+}
+function generateKnownDriftOnlySection(schemaStats, expectedDrift) {
+  const signals = getProductionSchemaSignals(null, schemaStats, expectedDrift);
+  const lines = [
+    "**\u672C\u756A\u30D7\u30EC\u30D3\u30E5\u30FC**: \u2705 \u672C\u756A\u30C7\u30D7\u30ED\u30A4\u304C\u5FC5\u8981\u306A\u30B9\u30AD\u30FC\u30DE\u5909\u66F4\u306F\u3042\u308A\u307E\u305B\u3093",
+    "",
+    "> \u{1F4CB} **\u65E2\u77E5\u306E\u5DEE\u5206\u306E\u307F\u691C\u51FA**",
+    ">",
+    "> Reference \u2194 Prod \u306B\u306F `expectedDrift` \u3067\u8A31\u5BB9\u6E08\u307F\u306E\u5DEE\u5206\u306E\u307F\u304C\u3042\u308A\u307E\u3059\u3002\u8FFD\u52A0\u306E db apply/deploy \u306F\u4E0D\u8981\u3067\u3059\u3002"
+  ];
+  for (const reason of signals.knownDriftReasons) {
+    lines.push(`> - ${reason}`);
+  }
+  lines.push("");
+  return lines;
+}
+function generateProductionPreviewSection(prodPreview, schemaDrift, schemaStats, expectedDrift) {
+  const signals = getProductionSchemaSignals(prodPreview, schemaStats, expectedDrift);
   if (!prodPreview?.executed) {
     if (schemaDrift?.gitDiff?.filesChanged?.length) {
       return [
@@ -5580,20 +6818,15 @@ function generateProductionPreviewSection(prodPreview, schemaDrift, schemaStats)
     return [];
   }
   if (prodPreview.error) return generatePreviewError(prodPreview.error);
-  if (prodPreview.hasChanges) {
-    const lines = [
-      "> \u{1F536} **\u30B9\u30AD\u30FC\u30DE\u5909\u66F4\u691C\u51FA - \u672C\u756A\u30C7\u30D7\u30ED\u30A4\u304C\u5FC5\u8981\u3067\u3059**",
-      ">",
-      "> \u3053\u306EPR\u3092\u30DE\u30FC\u30B8\u3057\u305F\u5F8C\u3001\u672C\u756A\u30C7\u30D7\u30ED\u30A4\u30EF\u30FC\u30AF\u30D5\u30ED\u30FC\u3092\u5B9F\u884C\u3057\u3066\u30B9\u30AD\u30FC\u30DE\u5909\u66F4\u3092\u9069\u7528\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
-      ""
-    ];
-    if (prodPreview.planSql) {
-      lines.push(...generatePreviewDetails(prodPreview));
-    }
-    return lines;
+  if (signals.previewHasChanges) {
+    return generatePreviewChangesDetectedSection(prodPreview, signals.previewOnlyChanges);
+  }
+  if (signals.previewMissedChanges) {
+    return generateComparisonMismatchSection(schemaStats, expectedDrift);
+  }
+  if (signals.hasKnownDriftOnly) {
+    return generateKnownDriftOnlySection(schemaStats, expectedDrift);
   }
-  const indexWarning = generateIndexDiffWarning(schemaStats);
-  if (indexWarning.length > 0) return indexWarning;
   return ["**\u672C\u756A\u30D7\u30EC\u30D3\u30E5\u30FC**: \u2705 \u672C\u756A\u306B\u9069\u7528\u3059\u308B\u30B9\u30AD\u30FC\u30DE\u5909\u66F4\u306F\u3042\u308A\u307E\u305B\u3093", ""];
 }
 function shouldShowDeployButton(productionPreview, schemaDrift, hasSchemaChanges2) {
@@ -5602,18 +6835,19 @@ function shouldShowDeployButton(productionPreview, schemaDrift, hasSchemaChanges
   if (!productionPreview?.executed && schemaDrift?.gitDiff?.filesChanged?.length) return true;
   return false;
 }
-function generateDeploySection(exitCode, layerResults, gitBranchName, productionPreview, schemaDrift, schemaStats, env) {
+function generateDeploySection(exitCode, layerResults, gitBranchName, productionPreview, schemaDrift, schemaStats, expectedDrift, env) {
   if (!checkIfDeployable(exitCode, layerResults)) return [];
   const deployWorkflowUrl = env.repository ? `${env.serverUrl}/${env.repository}/actions/workflows/deploy-db.yml` : null;
-  const hasPgSchemaDiffChanges = productionPreview?.hasChanges === true;
-  const hasIndexChanges = schemaStats?.local && schemaStats?.production ? hasIndexDiff(compareIndexLists(schemaStats.local, schemaStats.production)) : false;
-  const hasSchemaChanges2 = hasPgSchemaDiffChanges || hasIndexChanges;
+  const signals = getProductionSchemaSignals(productionPreview, schemaStats, expectedDrift);
+  const hasSchemaChanges2 = signals.requiresDeploy;
   const headerEmoji = hasSchemaChanges2 ? "\u{1F6A8}" : "\u{1F680}";
   const headerText = hasSchemaChanges2 ? "\u672C\u756A\u30C7\u30D7\u30ED\u30A4 (\u30B9\u30AD\u30FC\u30DE\u5909\u66F4\u3042\u308A!)" : "\u672C\u756A\u30C7\u30D7\u30ED\u30A4";
   const lines = ["---", "", `### ${headerEmoji} ${headerText}`, ""];
   if (exitCode !== 0)
     lines.push("> **\u6CE8**: Layer 4 (E2E) \u306F\u5931\u6557\u3057\u307E\u3057\u305F\u304C\u3001\u30B9\u30AD\u30FC\u30DE\u5909\u66F4\u306F\u30C7\u30D7\u30ED\u30A4\u53EF\u80FD\u3067\u3059\u3002", "");
-  lines.push(...generateProductionPreviewSection(productionPreview, schemaDrift, schemaStats));
+  lines.push(
+    ...generateProductionPreviewSection(productionPreview, schemaDrift, schemaStats, expectedDrift)
+  );
   const showButton = shouldShowDeployButton(productionPreview, schemaDrift, hasSchemaChanges2);
   if (deployWorkflowUrl && showButton) {
     const buttonText = hasSchemaChanges2 ? "\u26A1 \u30B9\u30AD\u30FC\u30DE\u5909\u66F4\u3092\u672C\u756A\u306B\u30C7\u30D7\u30ED\u30A4" : "\u25B6\uFE0F \u672C\u756A\u306B\u30C7\u30D7\u30ED\u30A4";
@@ -5653,6 +6887,7 @@ function generateIntermediateCommentBody(input) {
       productionPreview,
       schemaDrift,
       input.schemaStats ?? null,
+      input.expectedDrift ?? [],
       env
     ),
     "<sub>\u{1F916} RUNA CI \u751F\u6210 (\u4E2D\u9593\u66F4\u65B0)</sub>"
@@ -5688,6 +6923,7 @@ function generateCommentBody(input) {
       input.productionPreview,
       schemaDrift,
       input.schemaStats ?? null,
+      input.expectedDrift ?? [],
       env
     ),
     "<sub>\u{1F916} RUNA CI \u751F\u6210</sub>"
@@ -5737,7 +6973,7 @@ function formatSyncSchemaDetail(schemaDrift) {
   if (!hasGitChanges) {
     const hasSqlContent = schemaDrift.beforeSql && schemaDrift.beforeSql.trim().length > 0;
     if (hasSqlContent) {
-      return "ci.sql + pgTAP + roles";
+      return "ci.sql + prerequisite seeds";
     }
     return "SQL\u30D5\u30A1\u30A4\u30EB\u5909\u66F4\u306A\u3057";
   }
@@ -5777,7 +7013,7 @@ function formatRunTestsDetail(layerResults) {
 }
 var stepDetailHandlers = {
   syncSchema: (_status, schemaDrift) => formatSyncSchemaDetail(schemaDrift),
-  applySeeds: () => "ci.sql + pgTAP + roles",
+  applySeeds: () => "ci.sql + prerequisite seeds",
   staticChecks: (status) => status === "passed" ? "\u578B\u30C1\u30A7\u30C3\u30AF \u2713 lint \u2713" : "\u578B\u30C1\u30A7\u30C3\u30AF \u2717 \u307E\u305F\u306F lint \u2717",
   build: (status) => status === "passed" ? "\u30A2\u30D7\u30EA\u30D3\u30EB\u30C9\u5B8C\u4E86, Playwright\u6E96\u5099\u5B8C\u4E86" : "\u30D3\u30EB\u30C9\u5931\u6557",
   runTests: (_status, _schemaDrift, layerResults) => formatRunTestsDetail(layerResults)
@@ -6205,7 +7441,7 @@ function createInitialContext(input) {
 function createOutput(context) {
   return {
     mode: context.mode,
-    status: context.error ? "failure" : "success",
+    status: context.exitCode === 0 && !context.error ? "success" : "failure",
     repoKind: context.repoKind,
     steps: {},
     // Populated from summary
@@ -6410,7 +7646,7 @@ function createBuildAndPlaywrightInput(context) {
       enablePublicE2EFlag: true
     }),
     isCI: context.input.isCI ?? false,
-    skipPlaywright: context.selectedLayers.includes(4) ? false : true
+    skipPlaywright: !context.selectedLayers.includes(4)
   };
 }
 function createAppStartInput(context) {
@@ -6774,10 +8010,17 @@ var ciMachine = setup({
           databaseUrl: context.supabase?.databaseUrlRaw ?? "",
           mode: context.mode
         }),
-        onDone: {
-          actions: assign({ seedsApplied: ({ event }) => event.output.applied }),
-          target: "productionPreview"
-        },
+        onDone: [
+          {
+            guard: "isCiLocalMode",
+            actions: assign({ seedsApplied: ({ event }) => event.output.applied }),
+            target: "productionPreview"
+          },
+          {
+            actions: assign({ seedsApplied: ({ event }) => event.output.applied }),
+            target: "postSeedPr"
+          }
+        ],
         onError: {
           // Seeds failure is CRITICAL - blocks CI (Layer 2/3 tests depend on seeds)
           target: "failed",
@@ -6789,6 +8032,371 @@ var ciMachine = setup({
       }
     },
     // ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+    // Post-Seed PR Phase
+    // CI PR path only: run observability work in parallel with the critical build/test path
+    // ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+    postSeedPr: {
+      type: "parallel",
+      meta: {
+        e2e: {
+          observable: "log",
+          assertions: [{ type: "log", contains: "Database roles configured" }]
+        }
+      },
+      states: {
+        execution: {
+          initial: "setupRoles",
+          states: {
+            setupRoles: {
+              invoke: {
+                src: "setupRoles",
+                input: ({ context }) => createSetupRolesInput(context),
+                onDone: {
+                  target: "staticChecks",
+                  actions: assign({
+                    rolesSetup: true,
+                    supabase: ({ context, event }) => mergeSetupRolesSupabase(context, event.output.appDatabaseUrl)
+                  })
+                },
+                onError: {
+                  target: "staticChecks",
+                  actions: assign({ rolesSetup: false })
+                }
+              }
+            },
+            staticChecks: {
+              always: [{ guard: "shouldSkipStaticChecks", target: "buildAndPlaywright" }],
+              invoke: {
+                src: "staticChecks",
+                input: ({ context }) => createStaticChecksInput(context),
+                onDone: [
+                  {
+                    guard: ({ event }) => !event.output.passed,
+                    target: "failed",
+                    actions: assign({
+                      staticChecksPassed: false,
+                      error: ({ event }) => event.output.error ?? "Static checks failed"
+                    })
+                  },
+                  {
+                    target: "buildAndPlaywright",
+                    actions: assign({ staticChecksPassed: true })
+                  }
+                ],
+                onError: {
+                  target: "failed",
+                  actions: assign({
+                    staticChecksPassed: false,
+                    error: ({ event }) => extractErrorMessage2(event, "Static checks failed")
+                  })
+                }
+              }
+            },
+            buildAndPlaywright: {
+              always: [{ guard: "shouldSkipBuild", target: "appStart" }],
+              invoke: {
+                src: "buildAndPlaywright",
+                input: ({ context }) => ({
+                  ...createBuildAndPlaywrightInput(context),
+                  skipPlaywright: shouldSkipPlaywrightInstall(context)
+                }),
+                onDone: [
+                  {
+                    guard: ({ event }) => !event.output.buildPassed,
+                    target: "failed",
+                    actions: assign({
+                      appBuildPassed: false,
+                      playwrightInstalled: ({ event }) => event.output.playwrightInstalled,
+                      manifestGenerated: ({ event }) => event.output.manifestGenerated,
+                      error: ({ event }) => event.output.buildError ?? "App build failed"
+                    })
+                  },
+                  {
+                    target: "appStart",
+                    actions: assign({
+                      appBuildPassed: true,
+                      playwrightInstalled: ({ event }) => event.output.playwrightInstalled,
+                      manifestGenerated: ({ event }) => event.output.manifestGenerated
+                    })
+                  }
+                ],
+                onError: {
+                  target: "failed",
+                  actions: assign({
+                    appBuildPassed: false,
+                    error: ({ event }) => extractErrorMessage2(event, "App build failed")
+                  })
+                }
+              }
+            },
+            appStart: {
+              always: [{ guard: "shouldSkipAppStart", target: "capabilities" }],
+              invoke: {
+                src: "appStart",
+                input: ({ context }) => createAppStartInput(context),
+                onDone: [
+                  {
+                    guard: ({ event }) => !event.output.started,
+                    target: "failed",
+                    actions: assign({
+                      appStarted: false,
+                      error: ({ event }) => event.output.error ?? "App start failed"
+                    })
+                  },
+                  {
+                    target: "capabilities",
+                    actions: assign({
+                      appStarted: true,
+                      appPid: ({ event }) => event.output.pid ?? null,
+                      baseUrl: ({ event }) => event.output.baseUrl ?? null
+                    })
+                  }
+                ],
+                onError: {
+                  target: "failed",
+                  actions: assign({
+                    appStarted: false,
+                    error: ({ event }) => extractErrorMessage2(event, "App start failed")
+                  })
+                }
+              }
+            },
+            capabilities: {
+              invoke: {
+                src: "capabilities",
+                input: ({ context }) => createCapabilitiesInput(context),
+                onDone: {
+                  target: "runCoreTests",
+                  actions: assign({
+                    capabilities: ({ event }) => event.output.detected?.capabilities ?? [],
+                    selectedLayers: ({ context, event }) => filterRunnableLayers(context.selectedLayers, event.output.layerContent),
+                    layerSkipReasons: ({ event }) => extractLayerSkipReasons(event.output.layerContent)
+                  })
+                },
+                onError: {
+                  target: "runCoreTests"
+                }
+              }
+            },
+            runCoreTests: {
+              invoke: {
+                src: "runLayers",
+                input: ({ context }) => createRunCoreTestsInput(context),
+                onDone: [
+                  {
+                    guard: ({ event }) => {
+                      const failedLayers = event.output.failedLayers ?? [];
+                      return failedLayers.length > 0;
+                    },
+                    target: "coreTestsFailed",
+                    actions: assign({
+                      testsRun: true,
+                      layerResults: ({ event }) => deriveCoreLayerResults(event.output)
+                    })
+                  },
+                  {
+                    target: "coreTestsComplete",
+                    actions: assign({
+                      testsRun: true,
+                      layerResults: ({ context, event }) => {
+                        const nextResults = convertLayerResults(event.output.results);
+                        return mergeLayerResults(context.layerResults, nextResults);
+                      }
+                    })
+                  }
+                ],
+                onError: {
+                  target: "coreTestsFailed",
+                  actions: assign({
+                    testsRun: true,
+                    error: ({ event }) => extractErrorMessage2(event, "Core tests failed")
+                  })
+                }
+              }
+            },
+            coreTestsComplete: {
+              always: [
+                { guard: ({ context }) => hasE2ELayer(context.selectedLayers), target: "e2ePhase" },
+                {
+                  target: "done",
+                  actions: assign({
+                    exitCode: ({ context }) => computeExitCodeFromLayerResults(context.layerResults)
+                  })
+                }
+              ]
+            },
+            coreTestsFailed: {
+              entry: assign({
+                exitCode: ({ context }) => {
+                  if (Object.keys(context.layerResults).length === 0) {
+                    return 1;
+                  }
+                  return computeExitCodeFromLayerResults(context.layerResults);
+                }
+              }),
+              always: [{ target: "#ci.finalize" }]
+            },
+            e2ePhase: {
+              type: "parallel",
+              states: {
+                intermediateComment: {
+                  initial: "checking",
+                  states: {
+                    checking: {
+                      always: [
+                        {
+                          guard: ({ context }) => !context.prContext?.prNumber,
+                          target: "done"
+                        },
+                        {
+                          guard: ({ context }) => !shouldPostGitHubComment(context),
+                          target: "done"
+                        },
+                        { target: "posting" }
+                      ]
+                    },
+                    posting: {
+                      invoke: {
+                        src: "upsertComment",
+                        input: ({ context }) => createIntermediateCommentRequest(context),
+                        onDone: "done",
+                        onError: "done"
+                      }
+                    },
+                    done: { type: "final" }
+                  }
+                },
+                e2eTests: {
+                  initial: "running",
+                  states: {
+                    running: {
+                      invoke: {
+                        src: "runLayers",
+                        input: ({ context }) => createE2ERunLayersInput(context),
+                        onDone: {
+                          target: "done",
+                          actions: assign({
+                            layerResults: ({ context, event }) => {
+                              const e2eResults = convertLayerResults(event.output.results);
+                              return mergeLayerResults(context.layerResults, e2eResults);
+                            }
+                          })
+                        },
+                        onError: {
+                          target: "done",
+                          actions: assign({
+                            layerResults: ({ context }) => ({
+                              ...context.layerResults,
+                              [E2E_LAYER]: { status: "failed", exitCode: 1 }
+                            })
+                          })
+                        }
+                      }
+                    },
+                    done: { type: "final" }
+                  }
+                }
+              },
+              onDone: [
+                {
+                  guard: ({ context }) => Object.values(context.layerResults).some(
+                    (result) => result.status === "failed"
+                  ),
+                  target: "failed",
+                  actions: assign({
+                    exitCode: ({ context }) => computeExitCodeFromLayerResults(context.layerResults)
+                  })
+                },
+                {
+                  target: "done",
+                  actions: assign({
+                    exitCode: ({ context }) => computeExitCodeFromLayerResults(context.layerResults)
+                  })
+                }
+              ]
+            },
+            failed: {
+              always: [
+                {
+                  target: "#ci.finalize",
+                  actions: assign({
+                    exitCode: ({ context }) => context.exitCode !== 0 ? context.exitCode : 1
+                  })
+                }
+              ]
+            },
+            done: {
+              type: "final"
+            }
+          }
+        },
+        observability: {
+          initial: "productionPreview",
+          states: {
+            productionPreview: {
+              invoke: {
+                src: "productionPreview",
+                input: ({ context }) => ({
+                  repoRoot: assertRepoRoot(context),
+                  tmpDir: assertTmpDir(context),
+                  shouldExecute: Boolean(context.input.productionDatabaseUrl?.trim())
+                }),
+                onDone: {
+                  target: "collectSchemaStats",
+                  actions: assign({
+                    productionPreview: ({ event }) => event.output.preview
+                  })
+                },
+                onError: {
+                  target: "collectSchemaStats",
+                  actions: assign({
+                    productionPreview: ({ event }) => ({
+                      executed: true,
+                      planSql: null,
+                      hazards: [],
+                      hasChanges: false,
+                      error: event.error instanceof Error ? event.error.message : "Production preview failed"
+                    })
+                  })
+                }
+              }
+            },
+            collectSchemaStats: {
+              invoke: {
+                src: "collectSchemaStats",
+                input: ({ context }) => ({
+                  repoRoot: context.repoRoot ?? process.cwd(),
+                  referenceDbUrl: context.supabase?.databaseUrlRaw ?? null,
+                  ciDbUrl: context.supabase?.databaseUrlRaw ?? null,
+                  referenceStrategy: shouldReuseCiReferenceStats(context) ? "reuse-ci" : "rebuild",
+                  queryProduction: true,
+                  tmpDir: context.tmpDir ?? process.cwd()
+                }),
+                onDone: {
+                  target: "done",
+                  actions: assign({
+                    schemaStats: ({ event }) => event.output.schemaStats
+                  })
+                },
+                onError: {
+                  target: "done",
+                  actions: assign({
+                    schemaStats: () => null
+                  })
+                }
+              }
+            },
+            done: {
+              type: "final"
+            }
+          }
+        }
+      },
+      onDone: {
+        target: "finalize"
+      }
+    },
+    // ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
     // Production Preview (ci-pr modes only, when schema changes exist)
     // Runs dry-run against production to show what SQL would be applied
     // ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
@@ -6845,11 +8453,12 @@ var ciMachine = setup({
       invoke: {
         src: "collectSchemaStats",
         input: ({ context }) => ({
-          // In CI mode, local and CI both use the Docker Supabase
-          localDbUrl: context.supabase?.databaseUrlRaw ?? null,
+          repoRoot: context.repoRoot ?? process.cwd(),
+          referenceDbUrl: context.supabase?.databaseUrlRaw ?? null,
           ciDbUrl: context.supabase?.databaseUrlRaw ?? null,
-          // Query production only in ci-pr modes
-          queryProduction: context.mode !== "ci-local"
+          referenceStrategy: shouldReuseCiReferenceStats(context) ? "reuse-ci" : "rebuild",
+          queryProduction: context.mode !== "ci-local",
+          tmpDir: context.tmpDir ?? process.cwd()
         }),
         onDone: {
           target: "decidePath",
@@ -7383,6 +8992,19 @@ var STATE_TO_STEP = {
   pullProduction: "syncSchema",
   syncSchema: "syncSchema",
   applySeeds: "applySeeds",
+  postSeedPr: "applySeeds",
+  "postSeedPr.execution.setupRoles": "applySeeds",
+  "postSeedPr.execution.staticChecks": "staticChecks",
+  "postSeedPr.execution.buildAndPlaywright": "build",
+  "postSeedPr.execution.appStart": "build",
+  "postSeedPr.execution.capabilities": "build",
+  "postSeedPr.execution.runCoreTests": "runTests",
+  "postSeedPr.execution.coreTestsComplete": "runTests",
+  "postSeedPr.execution.coreTestsFailed": "runTests",
+  "postSeedPr.execution.e2ePhase": "runTests",
+  "postSeedPr.execution.done": "runTests",
+  "postSeedPr.observability.productionPreview": "applySeeds",
+  "postSeedPr.observability.collectSchemaStats": "applySeeds",
   decidePath: "applySeeds",
   installPgTap: "applySeeds",
   setupRoles: "applySeeds",
@@ -7420,6 +9042,17 @@ var STEP_ORDER = [
   "runTests",
   "finalize"
 ];
+function resolveStepForState(state) {
+  let cursor = state;
+  while (cursor.length > 0) {
+    const step = STATE_TO_STEP[cursor];
+    if (step) return step;
+    const nextDot = cursor.lastIndexOf(".");
+    if (nextDot === -1) break;
+    cursor = cursor.slice(0, nextDot);
+  }
+  return void 0;
+}
 function getCompletedSteps(currentStep) {
   const currentIndex = STEP_ORDER.indexOf(currentStep);
   if (currentIndex <= 0) return [];
@@ -7508,8 +9141,8 @@ function determineFailedStep(context) {
 function handleProgressCommentUpdate(snapshot, prevState) {
   const currentState = getStateName(snapshot);
   const context = snapshot.context;
-  const currentStep = STATE_TO_STEP[currentState];
-  const prevStep = STATE_TO_STEP[prevState];
+  const currentStep = resolveStepForState(currentState);
+  const prevStep = resolveStepForState(prevState);
   if (!currentStep || currentStep === prevStep) return;
   recordStepTiming(currentStep);
   if (currentStep === "finalize") {
@@ -7704,16 +9337,13 @@ var stateLogHandlers = {
     logger.info(`Running: ${ctx.selectedLayers.map((l) => `test layer${l}`).join(", ")}`);
   }
 };
-stateLogHandlers["setup.resolving"] = stateLogHandlers.setup;
-stateLogHandlers["setup.local"] = stateLogHandlers.setup;
-function handleStateChange(snapshot, prevState, logger) {
-  const state = getStateName(snapshot);
-  if (state === prevState) return;
-  const handler = stateLogHandlers[state];
-  if (handler) {
-    handler(snapshot.context, logger);
-  }
-}
+var handleStateChange = createMachineStateChangeLogger({
+  getState: getStateName,
+  getContext: (snapshot) => snapshot.context,
+  handlers: stateLogHandlers,
+  useParentState: true,
+  handlerArgumentOrder: "context-first"
+});
 function printSummary(logger, output) {
   endCurrentGroup();
   logSection2("Summary");
@@ -8052,6 +9682,7 @@ function logPlan2(steps) {
     console.log("");
   }
 }
+var CI_PR_UNKNOWN_STATE_LOG_SKIP = /* @__PURE__ */ new Set(["decidePath", "done", "failed"]);
 var stateLogHandlers2 = {
   // ─── Setup Phase ───────────────────────────────────────────
   setup: (_ctx, _logger) => {
@@ -8078,6 +9709,75 @@ var stateLogHandlers2 = {
     logSection3("Database: Apply Seeds (db seed)");
     logger.info("Running: pnpm exec runa db seed ci --auto-approve");
   },
+  "postSeedPr.execution.setupRoles": (ctx, logger) => {
+    if (ctx.seedsApplied) {
+      logger.success("Seeds applied successfully");
+    }
+    logSection3("Database: Setup Roles (db:setup-roles)");
+    logger.info("Running: pnpm db:setup-roles");
+  },
+  "postSeedPr.observability.productionPreview": (ctx, logger) => {
+    if (ctx.seedsApplied) {
+      logger.success("Seeds applied successfully");
+    }
+    logSection3("Database: Production Preview (dry-run)");
+    logger.info("Running: pnpm exec runa db apply production --check");
+  },
+  "postSeedPr.observability.collectSchemaStats": (ctx, logger) => {
+    if (ctx.productionPreview?.executed) {
+      if (ctx.productionPreview.hasChanges) {
+        logger.info("Production preview: schema changes detected");
+      } else {
+        logger.success("Production preview: no schema changes");
+      }
+    }
+    logSection3("Database: Collect Schema Statistics");
+    logger.info("Comparing Local/CI/Production schemas...");
+  },
+  "postSeedPr.execution.staticChecks": (ctx, logger) => {
+    if (ctx.rolesSetup) {
+      logger.success("Database roles configured");
+    }
+    logSection3("Static Checks: type-check + lint (parallel)");
+    logger.info("Running: pnpm type-check || pnpm lint");
+  },
+  "postSeedPr.execution.buildAndPlaywright": (ctx, logger) => {
+    if (ctx.staticChecksPassed) {
+      logger.success("Static checks passed");
+    }
+    logSection3("Build: App Build + Playwright Install (parallel)");
+    logger.info("Running: pnpm build || pnpm exec playwright install chromium");
+  },
+  "postSeedPr.execution.appStart": (ctx, logger) => {
+    if (ctx.appBuildPassed) {
+      logger.success("App build completed");
+    }
+    if (ctx.manifestGenerated) {
+      logger.success("Manifest generated (Layer 3 ready)");
+    } else if (ctx.manifestGenerated === false) {
+      logger.warn("Manifest generation failed (Layer 3 may be skipped)");
+    }
+    if (ctx.playwrightInstalled) {
+      logger.success("Playwright browsers installed");
+    }
+    logSection3("Start Application");
+    logger.info(`Starting app on port ${ctx.app?.port ?? 3e3}...`);
+  },
+  "postSeedPr.execution.capabilities": (ctx, logger) => {
+    if (ctx.appStarted) {
+      logger.success(`App started at ${ctx.baseUrl ?? "http://localhost:3000"}`);
+    }
+    logSection3("Detect Test Capabilities");
+  },
+  "postSeedPr.execution.runCoreTests": (ctx, logger) => {
+    const coreLayers = ctx.selectedLayers.filter((l) => l !== 4);
+    logSection3(`Core Tests: Layer ${coreLayers.join(", ")}`);
+    logger.info(`Running core layers: ${coreLayers.map((l) => `test layer${l}`).join(", ")}`);
+  },
+  "postSeedPr.execution.e2ePhase": (_ctx, logger) => {
+    logSection3("E2E Phase: Layer 4 + Intermediate Comment");
+    logger.info("Running Layer 4 E2E tests (parallel with intermediate PR comment)");
+  },
   productionPreview: (ctx, logger) => {
     if (ctx.seedsApplied) {
       logger.success("Seeds applied successfully");
@@ -8186,18 +9886,18 @@ var stateLogHandlers2 = {
     logSection3("Finalize: Post GitHub Comment");
   }
 };
-stateLogHandlers2["setup.resolving"] = stateLogHandlers2.setup;
-stateLogHandlers2["finalize.writeSummary"] = stateLogHandlers2.finalize;
-function handleStateChange2(snapshot, prevState, logger) {
-  const state = getStateName(snapshot);
-  if (state === prevState) return;
-  const handler = stateLogHandlers2[state];
-  if (handler) {
-    handler(snapshot.context, logger);
-  } else if (cliOutputFormat !== "json" && state !== "decidePath" && state !== "done" && state !== "failed") {
-    logger.info(`State: ${state}`);
+var handleStateChange2 = createMachineStateChangeLogger({
+  getState: getStateName,
+  getContext: (snapshot) => snapshot.context,
+  handlers: stateLogHandlers2,
+  useParentState: true,
+  handlerArgumentOrder: "context-first",
+  onUnknownState: (state, logger) => {
+    if (cliOutputFormat !== "json" && !CI_PR_UNKNOWN_STATE_LOG_SKIP.has(state)) {
+      logger.info(`State: ${state}`);
+    }
   }
-}
+});
 function printSummary2(logger, output) {
   logSection3("Summary");
   logger.info(`Mode: ${output.mode}`);
@@ -8284,7 +9984,7 @@ async function runCiPrCommand(options) {
     { id: "setup", description: "Start local Supabase instance" },
     {
       id: "db",
-      description: "db apply \u2192 db seed \u2192 production preview \u2192 schema stats \u2192 db:setup-roles"
+      description: "db apply \u2192 db seed \u2192 (production preview \u2225 schema stats \u2225 db:setup-roles)"
     },
     ...skipStaticChecks ? [] : [{ id: "static", description: "pnpm type-check + pnpm lint (parallel)" }],
     ...skipBuild ? [] : [{ id: "build", description: "pnpm build \u2192 manifest:generate + playwright install" }],