@sema-agent/server 7.5.0 → 7.7.0

package/dist/plugins/tidb-pool.js

@@ -74,8 +74,8 @@ export const SCHEMA_STATEMENTS = [
      -- setTitleIfNull — the user-facing RENAME layer lives BFF-side as a label overlay, not here).
      title       VARCHAR(120) NULL,
      PRIMARY KEY (session_id),
-     KEY idx_owner (owner)
-   )`,
+     KEY idx_session_meta_owner (owner)
+   ) COLLATE utf8mb4_bin`,
     `CREATE TABLE IF NOT EXISTS session_event (
      session_id  VARCHAR(64) NOT NULL,
      seq         BIGINT      NOT NULL,
@@ -85,11 +85,25 @@ export const SCHEMA_STATEMENTS = [
      payload     JSON        NOT NULL,
      ts          DATETIME(3) NOT NULL,
      PRIMARY KEY (session_id, seq),
-     UNIQUE KEY uk_entry (session_id, entry_id)
-   )`,
+     UNIQUE KEY uq_session_event_entry (session_id, entry_id)
+   ) COLLATE utf8mb4_bin`,
     // Async run registry (S1) + replayable event log (S2). Any instance can serve a run's status /
     // event replay because both live here, not in a single instance's memory.
     `CREATE TABLE IF NOT EXISTS task_run (
+     -- ⚠️ 表级 COLLATE 的**非键列**影响(#192 A11,codex 复审 2026-08-08 round2 点名——先前"只有
+     -- outcome_ledger 有聚合语义变化"的说法过窄,如实更正):
+     --  · \`status\`:sourceSummary() 的 GROUP BY 键之一,是**闭集词表**(running/failed/…)由服务端铸字面量
+     --    写入 ⇒ 字节分桶恒等于词表分桶,此变更对它无实际影响。
+     --  · \`source\`:同为 GROUP BY 键、且是 \`?source=\` 过滤列。🔴 **它不是闭集**(codex 复审 round3 纠正了
+     --    本注的前一版:那版写它限于 oa/cc-mcp/portal,是错的)——真实来源是运维在 \`SERVICE_AUTH_TOKENS\`
+     --    里写的 \`<token>=<system>\`,\`system\` 只过"非空"这一道(config.ts),大小写与重音全由运维自己定。
+     --    ⇒ 若某部署此前跑在 *_ci/_ai 库上、且配了只差大小写/重音的两个 system 名,升级后 sourceSummary 的
+     --    分桶会**分裂**、\`?source=\` 也从宽松匹配变成字节精确。零存量用户下无人受影响;要恢复"宽松"语义
+     --    应当去入口把 system 名规范化,而不是把库退回 *_ci(那会连隔离键一起放宽)。
+     --  · \`objective_preview\`:\`?q=\` 搜索谓词的被搜列。搜索侧用的是 \`LOWER(col) LIKE LOWER(?)\`
+     --    (run-store-sql.ts / pg-session-storage.ts 双方言同形,注里写明"collation-proof ci")⇒ 大小写面
+     --    本就不依赖排序规则,不受影响。**残留**:若某部署此前跑在 *_ai(accent-insensitive)库上,重音
+     --    折叠那一档会随之消失(LOWER() 不去重音)——零存量用户下无人受影响,但它是行为差,记在这里。
      task_id     VARCHAR(64)  NOT NULL,
      session_id  VARCHAR(64)  NOT NULL,
      owner       VARCHAR(190) NULL,
@@ -124,19 +138,19 @@ export const SCHEMA_STATEMENTS = [
      created_at  DATETIME(3)  NOT NULL,
      updated_at  DATETIME(3)  NOT NULL,
      PRIMARY KEY (task_id),
-     KEY idx_session_status (session_id, status),
-     KEY idx_owner (owner),
+     KEY idx_task_run_session_status (session_id, status),
+     KEY idx_task_run_owner (owner),
      -- idx_job: WHERE job_id = ? (work-view grouping) would full-scan without it.
-     KEY idx_job (job_id),
+     KEY idx_task_run_job (job_id),
      -- idx_created: listRuns ALWAYS ORDER BY created_at DESC — without this the trace list does a filesort on
      -- every query (deepseek council #2). Covers the unfiltered newest-first list; filtered lists narrow via
      -- idx_owner / idx_job first.
-     KEY idx_created (created_at)
+     KEY idx_task_run_created (created_at)
      -- ⛔ DELIBERATELY NO KEY idx_error_code (error_code) (dropped 2026-07-26, clay 裁): a whole-repo sweep found
      -- ZERO code paths that filter on error_code — every reference is a SET or a projection — so the index only
      -- ever served an operator's ad-hoc WHERE error_code LIKE 'budget.%', while every task_run write paid its
      -- maintenance cost. If you need that ad-hoc query, build the index temporarily and drop it after.
-   )`,
+   ) COLLATE utf8mb4_bin`,
     // Cross-replica circuit-breaker state (1.38). A row per breaker key ("<provider>:<id>"); each
     // replica write-through-caches its trips here and periodically refreshes so a provider outage is
     // learned fleet-wide instead of every replica re-discovering it. Advisory / eventually consistent
@@ -148,28 +162,28 @@ export const SCHEMA_STATEMENTS = [
      opened_at   DATETIME(3)  NULL,
      updated_at  DATETIME(3)  NOT NULL,
      PRIMARY KEY (breaker_key)
-   )`,
+   ) COLLATE utf8mb4_bin`,
     // Cross-replica per-key CUMULATIVE cost quota (design/30 P0-1). One row per (scope_key, aligned window
     // bucket); replicas atomically `micro = micro + delta` (write-behind aggregation), so spend is summed
     // fleet-wide without losing increments. scope_key is opaque (principal today; team/feature later).
     `CREATE TABLE IF NOT EXISTS cost_quota (
      scope_key     VARCHAR(190) NOT NULL,
      window_bucket BIGINT       NOT NULL,
-     micro         BIGINT       NOT NULL DEFAULT 0,
+     micro_usd     BIGINT       NOT NULL DEFAULT 0,
      updated_at    DATETIME(3)  NOT NULL,
      PRIMARY KEY (scope_key, window_bucket),
-     KEY idx_window (window_bucket)
-   )`,
+     KEY idx_cost_quota_window (window_bucket)
+   ) COLLATE utf8mb4_bin`,
     // Cross-replica per-key request rate limit (design/30 P0-2) — same write-behind-counter shape as
     // cost_quota (one row per key+aligned-window, atomic n = n + delta). Soft fleet-wide limiting.
     `CREATE TABLE IF NOT EXISTS rate_limit (
      limit_key     VARCHAR(190) NOT NULL,
      window_bucket BIGINT       NOT NULL,
-     n             INT          NOT NULL DEFAULT 0,
+     hits          INT          NOT NULL DEFAULT 0,
      updated_at    DATETIME(3)  NOT NULL,
      PRIMARY KEY (limit_key, window_bucket),
-     KEY idx_window (window_bucket)
-   )`,
+     KEY idx_rate_limit_window (window_bucket)
+   ) COLLATE utf8mb4_bin`,
     // Durable backing for offloaded large tool results (core 1.47/1.49). One row per offload ref
     // (`tr_<sessionId>_<toolCallId>`, globally unique → PK); content is the full tool output moved out of
     // context. Write-once (INSERT IGNORE); TTL-reaped by created_at (idx_created). LONGTEXT holds large
@@ -179,8 +193,8 @@ export const SCHEMA_STATEMENTS = [
      content    LONGTEXT     NOT NULL,
      created_at DATETIME(3)  NOT NULL,
      PRIMARY KEY (ref),
-     KEY idx_created (created_at)
-   )`,
+     KEY idx_tool_result_created (created_at)
+   ) COLLATE utf8mb4_bin`,
     `CREATE TABLE IF NOT EXISTS task_event (
      task_id  VARCHAR(64) NOT NULL,
      seq      BIGINT      NOT NULL,
@@ -188,7 +202,7 @@ export const SCHEMA_STATEMENTS = [
      data     JSON        NULL,
      ts       DATETIME(3) NOT NULL,
      PRIMARY KEY (task_id, seq)
-   )`,
+   ) COLLATE utf8mb4_bin`,
     // Single-active-run-per-session claim. PRIMARY KEY(session_id) makes the claim a unique-key
     // insert: TiDB enforces it even with no prior row (it lacks InnoDB gap locks, so a
     // SELECT…FOR UPDATE on an empty match would NOT serialize two concurrent zero-prior createRuns).
@@ -197,8 +211,8 @@ export const SCHEMA_STATEMENTS = [
      task_id    VARCHAR(64) NOT NULL,
      since      DATETIME(3) NOT NULL,
      PRIMARY KEY (session_id),
-     KEY idx_task (task_id)
-   )`,
+     KEY idx_task_active_task (task_id)
+   ) COLLATE utf8mb4_bin`,
     // ([2354]/[2356] A-5,5.0.0:F4 轮询车道的 `approval` 表 DDL 已随车道退役——存量库里的旧表留置不动,
     //  代码零读写;durable 门只用下面的 checkpoint 表。)
     // Durable-checkpoint (core 1.67 / design/45): a policy `ask` persisted as a suspended task so an operator
@@ -263,8 +277,11 @@ export const SCHEMA_STATEMENTS = [
      -- pending_steer_rev:pending_steer_queue 列**自己**的乐观锁计数(与 resolve/reopen 的 rev 是两个轴,
      -- 刻意不复用)。队列化之后 setPendingSteer 从「一条无条件 UPDATE」变成「读-改-写」,中间那道窗必须
      -- 有 CAS 守着,否则两个并发 steer 各读到同一份队列、后写者把前者的条目整个盖掉。
-     -- 🔴 为什么不拿队列列的旧值当守卫:本表没有显式 COLLATE,库默认多为 *_ci —— 字符串 <=> 在大小写
-     -- 不敏感的排序规则下会把两份只差字母大小写的 JSON 判等,CAS 假命中 = 丢一条指令。整数列没有这个面。
+     -- 🔴 为什么不拿队列列的旧值当守卫:整数计数是**按构造**唯一的,长 JSON 文本的相等性则取决于列的排序
+     -- 规则、字段序、空白与转义形 —— 任何一处判等松一点,CAS 就假命中一次 = 悄悄丢一条 steer 指令。
+     -- (#192 A11 更正:本注原先的理由写的是"本表没有显式 COLLATE,库默认多为 *_ci",那半**已不成立** ——
+     --  本表现在钉了 COLLATE utf8mb4_bin,大小写敏感面已由 schema 保证。但结论不变,只是理由回到更根本的
+     --  那条:文本相等性有太多与业务无关的自由度,整数没有。)
      -- **绝不**用它做 resolve 的 OCC:bump 它不影响 core 的 rev 语义。
      pending_steer_rev BIGINT  NOT NULL DEFAULT 0,
      -- risk_descriptor (design/80 riskDescriptor inbox): core's INERT CheckpointGate.riskDescriptor ({severity
@@ -273,9 +290,9 @@ export const SCHEMA_STATEMENTS = [
      -- NULL on gates with no descriptor.
      risk_descriptor TEXT        NULL,
      PRIMARY KEY (token),
-     KEY idx_status_deadline (status, deadline),
-     KEY idx_session_status (session_id, status)
-   )`,
+     KEY idx_checkpoint_status_deadline (status, deadline),
+     KEY idx_checkpoint_session_status (session_id, status)
+   ) COLLATE utf8mb4_bin`,
     // Service-side resume rebuild inputs (DURABLE-CHECKPOINT-PLAN §4.4a): sessionId-keyed because core's
     // put(token,cp) can't carry service scenario_ctx. GC'd by the reaper once its checkpoint is gone.
     `CREATE TABLE IF NOT EXISTS checkpoint_ctx (
@@ -283,7 +300,7 @@ export const SCHEMA_STATEMENTS = [
      ctx        JSON         NOT NULL,
      updated_at BIGINT       NOT NULL,
      PRIMARY KEY (session_id)
-   )`,
+   ) COLLATE utf8mb4_bin`,
     // E18 resume-at anchor map: the shell holds live E2 eventIds (never persisted by core); TaskSpec.resumeAt takes a
     // persisted SessionTreeEntry.id. This is the service-owned eventId→entryId translation. Keyed (session_id,event_id)
     // so resolve is a PK point-lookup; entry_id is the resolve target. owner = single-DB-fleet defense-in-depth (the
@@ -296,7 +313,7 @@ export const SCHEMA_STATEMENTS = [
      created_at DATETIME(3)  NOT NULL,
      PRIMARY KEY (session_id, event_id),
      KEY idx_resume_anchor_session (session_id)
-   )`,
+   ) COLLATE utf8mb4_bin`,
     // Per-session per-toolName approval exemption ("本会话不再询问") — an APPROVAL MEMORY the
     // F4 ask-gate consults AFTER deny/neverAuto (both always win). tool_name is CANONICAL space. GC'd with
     // the session (E21 delete). See sema-internal server/docs/design/APPROVAL-SESSION-EXEMPTION.md.
@@ -306,7 +323,7 @@ export const SCHEMA_STATEMENTS = [
      granted_by VARCHAR(190) NULL,
      created_at DATETIME(3)  NOT NULL,
      PRIMARY KEY (session_id, tool_name)
-   )`,
+   ) COLLATE utf8mb4_bin`,
     // SendUserFile server-side ledger (multi-tenant governance, 1.190.0 [768]②a second half): one row per issued
     // link — the scope↔object mapping the HASHED key segment deliberately hides from URLs (per-tenant list/revoke
     // handle). id = uuidv7 (time-ordered PK = the keyset cursor); scope = VERIFIED principal verbatim ("_" =
@@ -327,7 +344,7 @@ export const SCHEMA_STATEMENTS = [
      created_at DATETIME(3)  NOT NULL,
      PRIMARY KEY (id),
      KEY idx_sendfile_link_scope (scope, id)
-   )`,
+   ) COLLATE utf8mb4_bin`,
     // E6 durable SessionPolicyStore — operator-tightened per-(session,principal) tool-permission rules (CAS-versioned
     // tighten-only; core reads them at prepare-time, subtract-only). policy_key = sha256(JSON.stringify([sessionId,
     // principal ?? null])) — the SHA of core's exact composite key: a FIXED 64-char PK (an arbitrary-length / JSON-
@@ -352,7 +369,7 @@ export const SCHEMA_STATEMENTS = [
      updated_at DATETIME(3)  NOT NULL,
      PRIMARY KEY (policy_key),
      KEY idx_session_policy_session (session_id)
-   )`,
+   ) COLLATE utf8mb4_bin`,
     // E19 rewind-files — durable working-tree snapshots keyed by (scope=sessionId, snap_key=SessionTreeEntry.id; same
     // entryId anchor as E18). A per-(scope,key) manifest of relPath→blob_hash + content-addressed blobs (deduped across
     // all snapshots). core's captureManifest/applyManifest do the env walk/restore; this is just the durable persistence.
@@ -364,7 +381,7 @@ export const SCHEMA_STATEMENTS = [
      blob_hash CHAR(64)      NOT NULL,
      KEY idx_snapshot_manifest_sk (scope, snap_key),
      KEY idx_snapshot_manifest_blob (blob_hash)
-   )`,
+   ) COLLATE utf8mb4_bin`,
     // `bytes` is NULLABLE: a SQL-backend row carries the bytes inline; a MinIO-backend row keeps ONLY the INDEX
     // (blob_hash, byte_len, created_at) here with bytes NULL — the bytes live in MinIO. This INDEX row is what
     // gcOrphanBlobs / reap / deleteBySession (E21 purge) / sweepOrphanBlobs read to compute the orphan/grace SET, so
@@ -384,7 +401,7 @@ export const SCHEMA_STATEMENTS = [
      created_at DATETIME(3) NOT NULL,
      PRIMARY KEY (blob_hash),
      KEY idx_snapshot_blob_created (created_at)
-   )`,
+   ) COLLATE utf8mb4_bin`,
     // SVC-2 (core CORE-7) durable WorkflowJournalStore — the cross-replica resume journal for an LLM-authored workflow.
     // One row per (run_id, ordinal): `ordinal` = core's callKeyOrdinal(callKey) (the positional replay index), `result`
     // = JSON.stringify(TaskResult). The (run_id, ordinal) PK makes append IDEMPOTENT (ON DUPLICATE KEY = OVERWRITE /
@@ -405,7 +422,7 @@ export const SCHEMA_STATEMENTS = [
      result     MEDIUMTEXT   NOT NULL,
      created_at BIGINT       NOT NULL,
      PRIMARY KEY (run_id, ordinal)
-   )`,
+   ) COLLATE utf8mb4_bin`,
     // RB-242 / WF2 ([1981] core 拍板 a 形):cross-replica workflow resume admission lease. PK (source_run_id, scope)
     // = the bake-store idem_key precedent — the INSERT either wins the claim or collides with the current holder.
     // TTL is the CRASH backstop only (engine releases on terminal via releaseResumeClaim); see workflow-journal-store-sql.ts.
@@ -415,7 +432,7 @@ export const SCHEMA_STATEMENTS = [
      new_run_id    VARCHAR(191) NOT NULL,
      claimed_at    BIGINT       NOT NULL,
      PRIMARY KEY (source_run_id, scope)
-   )`,
+   ) COLLATE utf8mb4_bin`,
     // P1 (fleet failover, 2026-07-05): durable cross-replica WorkflowRunStore twin — one row per run, the full
     // WorkflowRun as a JSON blob + extracted index columns; `rev` column = the OCC authority (blob rev overlaid
     // on read). MEDIUMTEXT (16MB) >> the 4MB write guard in the store.
@@ -430,7 +447,7 @@ export const SCHEMA_STATEMENTS = [
      PRIMARY KEY (id),
      KEY idx_wfrun_scope_created (scope, created_at),
      KEY idx_wfrun_scope_status (scope, status)
-   )`,
+   ) COLLATE utf8mb4_bin`,
     // P1: cross-replica workflow completion inbox (the push half). seq = insertion order (re-enqueue
     // moves to tail via DELETE+INSERT). summary is bounded upstream (core notifier ≤4000).
     `CREATE TABLE IF NOT EXISTS workflow_completion_inbox (
@@ -453,7 +470,7 @@ export const SCHEMA_STATEMENTS = [
      PRIMARY KEY (session_id, run_id),
      UNIQUE KEY uq_wfinbox_seq (seq),
      KEY idx_wfinbox_session_seq (session_id, seq)
-   )`,
+   ) COLLATE utf8mb4_bin`,
     // P1: inbox fences AS ROWS — the actual point of the SQL port: a poll served on replica A must fence the
     // late notify landing on replica B (cross-replica). kind = served (per-runId) | purge (run_id='',
     // session-wide; owner_known=0 → conservative fence-all). Swept opportunistically on every write verb.
@@ -466,7 +483,7 @@ export const SCHEMA_STATEMENTS = [
      until_ms    BIGINT       NOT NULL,
      PRIMARY KEY (session_id, kind, run_id),
      KEY idx_wffence_until (until_ms)
-   )`,
+   ) COLLATE utf8mb4_bin`,
     // 1.108 review fix (lens③ HIGH): the notify JOURNAL twin — under WORKFLOW_RUN_STORE=auto the run store +
     // inbox were SQL but the notify journal stayed a replica-LOCAL File ledger, so a replica that died with an
     // un-acked notify stranded it forever (at-least-once silently degraded to at-most-once across replica death).
@@ -481,7 +498,7 @@ export const SCHEMA_STATEMENTS = [
      acked_at       BIGINT       NULL,
      PRIMARY KEY (run_id),
      KEY idx_wfnotify_acked (acked)
-   )`,
+   ) COLLATE utf8mb4_bin`,
     // Outcome ledger (design/73 §7) — one row per graded task run, keyed by
     // (task_signature, model). v1 is READ-ONLY (dashboard + offline-backtest source); it drives NO
     // automatic policy change — that is flag-gated and must first pass an offline-backtest gate
@@ -491,6 +508,12 @@ export const SCHEMA_STATEMENTS = [
     // `outcome` is DERIVED from mechanical fields only (council blocker 1).
     `CREATE TABLE IF NOT EXISTS outcome_ledger (
      id             VARCHAR(64)  NOT NULL,
+     -- ⚠️ 表级 COLLATE 对本表**不只是钉住隔离键**(#192 A11,codex 复审 2026-08-08 点名):下面两列是
+     -- \`summary()\` 的 GROUP BY / ORDER BY 键(outcome-ledger-sql.ts),所以排序规则直接决定**分桶**。
+     -- utf8mb4_bin ⇒ 大小写/重音不同的 model id 各成一桶。这是**有意的**:model id 与 task signature 是
+     -- 机器铸的标识,不是自然语言;把 "GPT-x" 与 "gpt-x" 合成一桶是在替调用方猜,猜错了就是把两次不同
+     -- 实验的分数搅在一起。代价如实记:若某个部署此前跑在 *_ci 库上,升级后历史桶会**分裂**、顺序也会变
+     -- (字节序而非语言序)——零存量用户下无人受影响,但它是行为变化,不是纯粹的钉。
      task_signature VARCHAR(190) NOT NULL,
      model          VARCHAR(190) NOT NULL,
      task_id        VARCHAR(64)  NULL,
@@ -513,10 +536,10 @@ export const SCHEMA_STATEMENTS = [
      core_outcome   JSON         NULL,
      created_at     DATETIME(3)  NOT NULL,
      PRIMARY KEY (id),
-     KEY idx_sig_model (task_signature, model, run_status),
-     KEY idx_outcome (outcome),
-     KEY idx_created (created_at)
-   )`,
+     KEY idx_outcome_ledger_sig_model (task_signature, model, run_status),
+     KEY idx_outcome_ledger_outcome (outcome),
+     KEY idx_outcome_ledger_created (created_at)
+   ) COLLATE utf8mb4_bin`,
     // sandbox-image-pool control API (IMAGE-API-DESIGN.md §1 / pool design §8). One row per image DIGEST (the
     // immutable runtime ref); a queryable projection of build.sh's replay-sufficient manifest + the publish lifecycle.
     `CREATE TABLE IF NOT EXISTS sandbox_image_index (
@@ -543,10 +566,10 @@ export const SCHEMA_STATEMENTS = [
      updated_at         DATETIME(3)  NOT NULL,
      PRIMARY KEY (id),
      UNIQUE KEY uq_repo_digest (repo, digest),
-     KEY idx_profile_status (profile, status, visibility),
-     KEY idx_digest (digest),
-     KEY idx_tenant (tenant_id, status)
-   )`,
+     KEY idx_sandbox_image_index_profile_status (profile, status, visibility),
+     KEY idx_sandbox_image_index_digest (digest),
+     KEY idx_sandbox_image_index_tenant (tenant_id, status)
+   ) COLLATE utf8mb4_bin`,
     // sandbox-image-pool BAKE job (IMAGE-API-DESIGN.md §P2.6). A dedicated row table — NOT a reuse of task_run
     // (FK-coupled to task_active + the run reaper + /v1/runs list; co-mingling bakes would leak non-task rows into
     // reapStale/listRuns). The reader polls the COARSE 4-value `status` (queued|running|done|failed) for SSE
@@ -558,9 +581,9 @@ export const SCHEMA_STATEMENTS = [
      profile          VARCHAR(128) NOT NULL,
      bands            JSON         NULL,
      base_ref         VARCHAR(255) NULL,
-     push             TINYINT      NOT NULL DEFAULT 0,
-     dry_run          TINYINT      NOT NULL DEFAULT 0,
-     logs             TINYINT      NOT NULL DEFAULT 0,
+     push             TINYINT(1)      NOT NULL DEFAULT 0,
+     dry_run          TINYINT(1)      NOT NULL DEFAULT 0,
+     logs             TINYINT(1)      NOT NULL DEFAULT 0,
      argv             JSON         NOT NULL,
      status           VARCHAR(16)  NOT NULL,
      state            VARCHAR(16)  NULL,
@@ -577,19 +600,19 @@ export const SCHEMA_STATEMENTS = [
      ingest_secret    VARCHAR(64)  NULL,
      runner_id        VARCHAR(64)  NULL,
      lease_until      DATETIME(3)  NULL,
-     cancel_requested TINYINT      NOT NULL DEFAULT 0,
+     cancel_requested TINYINT(1)      NOT NULL DEFAULT 0,
      requested_by     VARCHAR(128) NULL,
      created_at       DATETIME(3)  NOT NULL,
      updated_at       DATETIME(3)  NOT NULL,
      PRIMARY KEY (bake_id),
-     UNIQUE KEY uq_idem (idem_key),
-     KEY idx_status (status),
-     KEY idx_created (created_at)
-   )`,
+     UNIQUE KEY uq_image_bake_idem (idem_key),
+     KEY idx_image_bake_status (status),
+     KEY idx_image_bake_created (created_at)
+   ) COLLATE utf8mb4_bin`,
     // Per-bake replayable event log (P2.6) — run-trace event-log mechanics ((id,seq) PK, ++seq, getEvents(after),
     // maxSeq, retainedFrom→416, heartbeat-not-persisted) WITHOUT the task_event FK coupling. image-api is the SOLE
     // ++seq writer (seq monotonic from 1). `line_ord` is the runner's per-line ordinal — the at-least-once ingest
-    // dedupe key (uq_line): a re-sent (bakeId,line_ord) is a no-op (P2.10). `level='raw'` rows are the opt-in
+    // dedupe key (uq_image_bake_event_line): a re-sent (bakeId,line_ord) is a no-op (P2.10). `level='raw'` rows are the opt-in
     // build.log tail (?logs=1), pruned on a tighter TTL + evicted first (P2.5/P2.9).
     `CREATE TABLE IF NOT EXISTS image_bake_event (
      bake_id  VARCHAR(64) NOT NULL,
@@ -600,8 +623,8 @@ export const SCHEMA_STATEMENTS = [
      data     JSON        NULL,
      ts       DATETIME(3) NOT NULL,
      PRIMARY KEY (bake_id, seq),
-     UNIQUE KEY uq_line (bake_id, line_ord)
-   )`,
+     UNIQUE KEY uq_image_bake_event_line (bake_id, line_ord)
+   ) COLLATE utf8mb4_bin`,
     // Single-flight build lease (P2.7, §9). ONE row per builder pool — image-api owns the authoritative lease so the
     // one docker daemon never has two concurrent builds (a prune-behind-lock could evict layers an in-flight build
     // needs). `expires_at` makes a crashed-runner lease stealable (CAS on expiry).
@@ -611,7 +634,7 @@ export const SCHEMA_STATEMENTS = [
      acquired_at DATETIME(3) NOT NULL,
      expires_at  DATETIME(3) NOT NULL,
      PRIMARY KEY (pool)
-   )`,
+   ) COLLATE utf8mb4_bin`,
     // Admission sentinel: ONE always-present row per builder pool, `SELECT … FOR UPDATE`-locked to SERIALIZE the
     // createBakeIfIdle busy-check+insert. A bare conditional INSERT…SELECT WHERE NOT EXISTS does NOT serialize two
     // concurrent admissions under TiDB's REPEATABLE READ (nor PG's READ COMMITTED), so without this lock two keyless
@@ -619,7 +642,7 @@ export const SCHEMA_STATEMENTS = [
     `CREATE TABLE IF NOT EXISTS image_bake_admit (
      pool VARCHAR(32) NOT NULL,
      PRIMARY KEY (pool)
-   )`,
+   ) COLLATE utf8mb4_bin`,
     // #151(design/172)流内审批协议持久层的两张表。真源 = approval-ask-store-sql.ts 的
     // `TIDB_APPROVAL_ASK_STATEMENTS`(那里与 PG twin 并排,方言差异一眼可对);展开进这个数组是为了让它们
     // 跟着中央 `ensureSchema` 在 **named-lock 的那条 conn** 上建 —— 把 pool 级 ensure 函数塞进执行循环

package/dist/plugins/tidb-rate-limiter.js

@@ -4,7 +4,7 @@ export class TiDBRateLimiter {
     counter;
     constructor(pool, limit, windowMs = 60_000, now, onDegraded, queryTimeoutMs) {
         this.limit = limit;
-        this.counter = new WriteBehindCounter(pool, { table: "rate_limit", keyCol: "limit_key", valCol: "n" }, windowMs, now, onDegraded, queryTimeoutMs);
+        this.counter = new WriteBehindCounter(pool, { table: "rate_limit", keyCol: "limit_key", valCol: "hits" }, windowMs, now, onDegraded, queryTimeoutMs);
     }
     check(key) {
         if (this.limit <= 0)

package/dist/plugins/tidb-session-store.js

@@ -15,11 +15,8 @@ import { StoredSession, SessionError, uuidv7, validateEntriesForImport, leafIdAf
 import { TiDBSessionStorage } from "./tidb-session-storage.js";
 import { escapeLike } from "./sql-escape.js";
 import { contentForkRelation, fastForwardSharedContentDiverged } from "../session-sync-content.js";
-import { classifySyncRelationshipByIds, SyncConflictError, stagingIdFor, STAGING_ID_MARKER, } from "../session-sync-kernel.js";
-/** Staging-row reaper grace window — a staging session's rows are GC'able only if it has NO session_meta (never
- *  committed) AND its OLDEST row is older than this (an in-flight stream keeps appending fresh rows → safe). Mirrors
- *  the file-snapshot store's BLOB_GC_GRACE_MS discipline (an in-flight import must never be reaped mid-stream). */
-const STAGING_GC_GRACE_MS = 3_600_000;
+import { classifySyncRelationshipByIds, SyncConflictError, stagingIdFor, STAGING_ID_MARKER, STAGING_GC_GRACE_MS, // 两孪生店同源(理由见 kernel 处顶注:同值双抄单边改值 ⇒ 两后端 GC 判定分家)
+ } from "../session-sync-kernel.js";
 export class TiDBSessionStore {
     pool;
     /** In-flight acquisitions keyed by id, so concurrent acquire(sameId) in one process share one. */

package/dist/plugins/tool-result-store-sql.js

@@ -44,8 +44,8 @@ import { mysqlDriver, pgDriver } from "./sql-driver.js";
  *  tables, so a self-contained ensureSchema is safe (central pg-pool aggregation is done separately). */
 export const PG_TOOL_RESULT_SCHEMA = [
     `CREATE TABLE IF NOT EXISTS tool_result (
-     ref        VARCHAR(190) NOT NULL,
-     content    TEXT         NOT NULL,
+     ref        VARCHAR(190) COLLATE "C" NOT NULL,
+     content    TEXT COLLATE "C"         NOT NULL,
      created_at TIMESTAMPTZ(3) NOT NULL,
      PRIMARY KEY (ref)
    )`,

package/dist/plugins/usage-window-store-sql.js

@@ -39,18 +39,18 @@ function parseRecord(raw, key) {
 }
 export async function ensureTiDBUsageWindowSchema(pool) {
     await pool.query(`CREATE TABLE IF NOT EXISTS ${USAGE_WINDOW_TABLE} (
-    k VARCHAR(190) NOT NULL,
+    usage_key VARCHAR(190) NOT NULL,
     record LONGTEXT NOT NULL,
     updated_at_ms BIGINT NOT NULL,
-    PRIMARY KEY (k)
+    PRIMARY KEY (usage_key)
   ) COLLATE utf8mb4_bin`);
 }
 export async function ensurePgUsageWindowSchema(q) {
     await q(`CREATE TABLE IF NOT EXISTS ${USAGE_WINDOW_TABLE} (
-    k VARCHAR(190) NOT NULL,
-    record TEXT NOT NULL,
+    usage_key VARCHAR(190) COLLATE "C" NOT NULL,
+    record TEXT COLLATE "C" NOT NULL,
     updated_at_ms BIGINT NOT NULL,
-    PRIMARY KEY (k)
+    PRIMARY KEY (usage_key)
   )`);
 }
 export class TiDBUsageWindowStore {
@@ -63,19 +63,19 @@ export class TiDBUsageWindowStore {
         try {
             await c.beginTransaction();
             // ensure-first:幂等建空行(EMPTY record)⇒ 下一步 FOR UPDATE 行恒在(锁语义干净,无 gap-lock 死锁形)。
-            await c.query(`INSERT IGNORE INTO ${USAGE_WINDOW_TABLE} (k, record, updated_at_ms) VALUES (?, ?, ?)`, [
+            await c.query(`INSERT IGNORE INTO ${USAGE_WINDOW_TABLE} (usage_key, record, updated_at_ms) VALUES (?, ?, ?)`, [
                 key,
                 JSON.stringify(EMPTY_USAGE_WINDOW_RECORD),
                 at,
             ]);
-            const [rows] = (await c.query(`SELECT record FROM ${USAGE_WINDOW_TABLE} WHERE k = ? FOR UPDATE`, [key]));
+            const [rows] = (await c.query(`SELECT record FROM ${USAGE_WINDOW_TABLE} WHERE usage_key = ? FOR UPDATE`, [key]));
             if (rows.length === 0) {
                 // 本表无删除臂(不同于 mailbox 的 drop/reap),ensure 后空 = 真障碍 fail-loud。
                 throw new Error(`usage_window row for key "${key}" vanished between ensure and lock — refusing to drop a governance charge`);
             }
             const record = parseRecord(rows[0].record, key);
             const next = chargeUsageRecord(record, tokens, at, windows);
-            await c.query(`UPDATE ${USAGE_WINDOW_TABLE} SET record = ?, updated_at_ms = ? WHERE k = ?`, [JSON.stringify(next), at, key]);
+            await c.query(`UPDATE ${USAGE_WINDOW_TABLE} SET record = ?, updated_at_ms = ? WHERE usage_key = ?`, [JSON.stringify(next), at, key]);
             await c.commit();
         }
         catch (e) {
@@ -87,7 +87,7 @@ export class TiDBUsageWindowStore {
         }
     }
     async read(key, windows, now) {
-        const [rows] = (await this.pool.query(`SELECT record FROM ${USAGE_WINDOW_TABLE} WHERE k = ?`, [key]));
+        const [rows] = (await this.pool.query(`SELECT record FROM ${USAGE_WINDOW_TABLE} WHERE usage_key = ?`, [key]));
         const record = rows.length === 0 ? EMPTY_USAGE_WINDOW_RECORD : parseRecord(rows[0].record, key);
         return readUsageRecord(record, windows, now);
     }
@@ -103,18 +103,18 @@ export class PgUsageWindowStore {
             await c.query("BEGIN");
             // ensure-first(TiDB 同注):ON CONFLICT DO NOTHING 幂等建空行,再锁——插入不带锁,锁只从
             // FOR UPDATE 来(复审靶1 的 PG 交错:并发首充双双 ensure,后到方 DO NOTHING 后必须真锁行)。
-            await c.query(`INSERT INTO ${USAGE_WINDOW_TABLE} (k, record, updated_at_ms) VALUES ($1, $2, $3) ON CONFLICT (k) DO NOTHING`, [
+            await c.query(`INSERT INTO ${USAGE_WINDOW_TABLE} (usage_key, record, updated_at_ms) VALUES ($1, $2, $3) ON CONFLICT (usage_key) DO NOTHING`, [
                 key,
                 JSON.stringify(EMPTY_USAGE_WINDOW_RECORD),
                 at,
             ]);
-            const { rows } = await c.query(`SELECT record FROM ${USAGE_WINDOW_TABLE} WHERE k = $1 FOR UPDATE`, [key]);
+            const { rows } = await c.query(`SELECT record FROM ${USAGE_WINDOW_TABLE} WHERE usage_key = $1 FOR UPDATE`, [key]);
             if (rows.length === 0) {
                 throw new Error(`usage_window row for key "${key}" vanished between ensure and lock — refusing to drop a governance charge`);
             }
             const record = parseRecord(rows[0].record, key);
             const next = chargeUsageRecord(record, tokens, at, windows);
-            await c.query(`UPDATE ${USAGE_WINDOW_TABLE} SET record = $1, updated_at_ms = $2 WHERE k = $3`, [JSON.stringify(next), at, key]);
+            await c.query(`UPDATE ${USAGE_WINDOW_TABLE} SET record = $1, updated_at_ms = $2 WHERE usage_key = $3`, [JSON.stringify(next), at, key]);
             await c.query("COMMIT");
         }
         catch (e) {
@@ -126,7 +126,7 @@ export class PgUsageWindowStore {
         }
     }
     async read(key, windows, now) {
-        const { rows } = await this.pool.query(`SELECT record FROM ${USAGE_WINDOW_TABLE} WHERE k = $1`, [key]);
+        const { rows } = await this.pool.query(`SELECT record FROM ${USAGE_WINDOW_TABLE} WHERE usage_key = $1`, [key]);
         const record = rows.length === 0 ? EMPTY_USAGE_WINDOW_RECORD : parseRecord(rows[0].record, key);
         return readUsageRecord(record, windows, now);
     }

package/dist/plugins/write-behind-counter.d.ts

@@ -42,7 +42,7 @@ export interface CounterTable {
  *  kind (0 = recovered); `prevStreak` lets the consumer detect the recovery edge. Shared by both dialects. */
 export interface CounterDegradeInfo {
     table: string;
-    kind: "flush" | "refresh" | "stalled";
+    kind: "flush" | "refresh" | "stalled" | "reap";
     streak: number;
     prevStreak: number;
     error?: string;
@@ -91,7 +91,15 @@ export declare class SqlWriteBehindCounter {
     private flushOnce;
     /** Load the current window's fleet totals into the cache (pendingDelta is separate → never clobbered). */
     refresh(): Promise<void>;
-    /** Delete expired window buckets to bound the table. */
+    /**
+     * Delete expired window buckets to bound the table.
+     *
+     * 🔴 失败**必须留痕**(#192 codex 复审 round2 修):这里原先是裸 `catch { return 0 }` —— 一个只影响
+     * DELETE 的故障(权限被收回、引擎单独拒 DELETE)会被吞成"删了 0 行",而 flush/refresh 两条腿照常成功
+     * ⇒ 健康遥测全绿,同时 rate_limit / cost_quota 的历史桶无界增长。那正是本仓禁止的静默 fail-open。
+     * 处置是**留痕不改失败方向**:清理是 best-effort,失败仍返回 0(把一次运维层面的清理失败升级成业务
+     * 失败是错的方向),但走与 flush/refresh 同一套 `bump()` ⇒ 有连败计数、有降级钩子、有恢复边沿。
+     */
     reap(): Promise<number>;
     startRefresh(intervalMs?: number): this;
     stop(): void;

package/dist/plugins/write-behind-counter.js

@@ -171,16 +171,26 @@ export class SqlWriteBehindCounter {
             this.bump("refresh", true, err); // S9
         }
     }
-    /** Delete expired window buckets to bound the table. */
+    /**
+     * Delete expired window buckets to bound the table.
+     *
+     * 🔴 失败**必须留痕**(#192 codex 复审 round2 修):这里原先是裸 `catch { return 0 }` —— 一个只影响
+     * DELETE 的故障(权限被收回、引擎单独拒 DELETE)会被吞成"删了 0 行",而 flush/refresh 两条腿照常成功
+     * ⇒ 健康遥测全绿,同时 rate_limit / cost_quota 的历史桶无界增长。那正是本仓禁止的静默 fail-open。
+     * 处置是**留痕不改失败方向**:清理是 best-effort,失败仍返回 0(把一次运维层面的清理失败升级成业务
+     * 失败是错的方向),但走与 flush/refresh 同一套 `bump()` ⇒ 有连败计数、有降级钩子、有恢复边沿。
+     */
     async reap() {
         try {
             const { affected } = await this.exec(this.dialect === "tidb"
                 ? `DELETE FROM ${this.t.table} WHERE window_bucket < ?`
                 : `DELETE FROM ${this.t.table} WHERE window_bucket < $1`, [this.bucket()]);
+            this.bump("reap", false); // 恢复边沿(健康时是 no-op)
             return affected;
         }
-        catch {
-            return 0;
+        catch (err) {
+            this.bump("reap", true, err);
+            return 0; // best-effort:留痕之后照旧不抛
         }
     }
     startRefresh(intervalMs = 5_000) {

package/dist/resource-suspend.d.ts

@@ -6,7 +6,9 @@
  * `POST /v1/assistant/tasks/:id/resume`) instead of FAILING; absent ⇒ a limit still FAILS.
  *
  * 🔴 EXCLUDE verify/cascade tasks. Core runs their implementation via `runWithVerification`/`runCascade`, which
- * map an inner durable suspend to a FAILED result (`errorCode: "suspended.awaiting_approval"`,core 5.9.0 W1 改名). The service would then
+ * map an inner durable suspend to a FAILED result (`errorCode: "unexpected.suspended"`,内层 status
+ * "needs_review" 时铸 `"unexpected.needs_review"` —— 真源是 core `agents/suspend-guard.js` 的
+ * `mapNestedSuspend`;`suspended.*` 三码是 bg 子代/委派报告面的词,不落在这条 TaskResult 腿上). The service would then
  * `setTerminal(failed)` while core had already minted a pending `resource_limit` checkpoint + suspended the
  * remote VM — ORPHANING both (the run row is terminal, so nothing resumes them). So a resource-limit hit on a
  * verify/cascade task must FAIL CLEANLY (no suspend), exactly as before the flag. This exclusion is the SAME

package/dist/resource-suspend.js

@@ -6,7 +6,9 @@
  * `POST /v1/assistant/tasks/:id/resume`) instead of FAILING; absent ⇒ a limit still FAILS.
  *
  * 🔴 EXCLUDE verify/cascade tasks. Core runs their implementation via `runWithVerification`/`runCascade`, which
- * map an inner durable suspend to a FAILED result (`errorCode: "suspended.awaiting_approval"`,core 5.9.0 W1 改名). The service would then
+ * map an inner durable suspend to a FAILED result (`errorCode: "unexpected.suspended"`,内层 status
+ * "needs_review" 时铸 `"unexpected.needs_review"` —— 真源是 core `agents/suspend-guard.js` 的
+ * `mapNestedSuspend`;`suspended.*` 三码是 bg 子代/委派报告面的词,不落在这条 TaskResult 腿上). The service would then
  * `setTerminal(failed)` while core had already minted a pending `resource_limit` checkpoint + suspended the
  * remote VM — ORPHANING both (the run row is terminal, so nothing resumes them). So a resource-limit hit on a
  * verify/cascade task must FAIL CLEANLY (no suspend), exactly as before the flag. This exclusion is the SAME