@sema-agent/server 7.5.0 → 7.7.0

package/dist/plugins/pg-pool.js

@@ -38,16 +38,25 @@ import { ensurePgImageBakeSchema as ensureImageBakeSchema } from "./image-bake-s
 import { ensurePgApprovalAskSchema } from "./approval-ask-store-sql.js";
 export const PG_SCHEMA_STATEMENTS = [
     `CREATE TABLE IF NOT EXISTS task_run (
-     task_id     VARCHAR(64)  NOT NULL,
-     session_id  VARCHAR(64)  NOT NULL,
-     owner       VARCHAR(190),
-     status      VARCHAR(16)  NOT NULL,
+     task_id     VARCHAR(64) COLLATE "C"  NOT NULL,
+     session_id  VARCHAR(64) COLLATE "C"  NOT NULL,
+     owner       VARCHAR(190) COLLATE "C",
+     status      VARCHAR(16) COLLATE "C"  NOT NULL,
      result      JSONB,
-     error       TEXT,
-     error_code  VARCHAR(64),
-     instance_id VARCHAR(64),
-     job_id      VARCHAR(64),
-     source      VARCHAR(64),
+     error       TEXT COLLATE "C",
+     error_code  VARCHAR(64) COLLATE "C",
+     instance_id VARCHAR(64) COLLATE "C",
+     job_id      VARCHAR(64) COLLATE "C",
+     source      VARCHAR(64) COLLATE "C",
+     -- 🔴 **刻意不写 COLLATE C** —— 本表其余字符串列都钉了,只有这一根是例外,理由是实测出来的
+     -- (#192,codex 复审 round5;证据 scratchpad/evidence/u6-lower-collate-c.txt):
+     --   PG 的 lower() 按**表达式的排序规则**决定大小写映射,而 C 只带 ASCII 映射 ⇒
+     --   lower('ÄPFEL Deploy') 在 C 下得到 'Äpfel deploy'(非 ASCII 原样不折),于是
+     --   ?q=äpfel 的 LOWER(objective_preview) LIKE LOWER($1) 谓词**一条都搜不到**(实测 0 命中;
+     --   库默认排序规则下是 1 命中)。MySQL 孪生没有这个面:utf8mb4_bin 下 LOWER() 照样折 Unicode
+     --   (实测 LOWER('ÄPFEL')='äpfel',搜得到)⇒ 把这一列也钉成 C 反而**制造**了一处方言分叉。
+     -- ⇒ 判据分轴:身份/隔离键要字节判等(钉 C);**人写的可搜文本**要 Unicode 大小写折叠(随库默认)。
+     --   本列是后者唯一的成员;新增可搜列请照此处理,并在排序规则门的例外表里登记。
      objective_preview VARCHAR(160),
      cancel_requested  SMALLINT NOT NULL DEFAULT 0,
      preempt_requested SMALLINT NOT NULL DEFAULT 0,
@@ -60,29 +69,29 @@ export const PG_SCHEMA_STATEMENTS = [
     `CREATE INDEX IF NOT EXISTS idx_task_run_created ON task_run (created_at)`,
     `CREATE INDEX IF NOT EXISTS idx_task_run_job ON task_run (job_id)`,
     `CREATE TABLE IF NOT EXISTS task_event (
-     task_id VARCHAR(64) NOT NULL,
+     task_id VARCHAR(64) COLLATE "C" NOT NULL,
      seq     BIGINT      NOT NULL,
-     type    VARCHAR(24) NOT NULL,
+     type    VARCHAR(24) COLLATE "C" NOT NULL,
      data    JSONB,
      ts      TIMESTAMPTZ(3) NOT NULL,
      PRIMARY KEY (task_id, seq)
    )`,
     `CREATE TABLE IF NOT EXISTS task_active (
-     session_id VARCHAR(64) NOT NULL,
-     task_id    VARCHAR(64) NOT NULL,
+     session_id VARCHAR(64) COLLATE "C" NOT NULL,
+     task_id    VARCHAR(64) COLLATE "C" NOT NULL,
      since      TIMESTAMPTZ(3) NOT NULL,
      PRIMARY KEY (session_id)
    )`,
     `CREATE INDEX IF NOT EXISTS idx_task_active_task ON task_active (task_id)`,
     // Durable-checkpoint (core 1.67 / design/45) — the FULL table (matches tidb-pool.ts checkpoint + its migrations).
     `CREATE TABLE IF NOT EXISTS checkpoint (
-     token        VARCHAR(120) NOT NULL,
-     scope        VARCHAR(190) NOT NULL,
-     session_id   VARCHAR(190) NOT NULL,
+     token        VARCHAR(120) COLLATE "C" NOT NULL,
+     scope        VARCHAR(190) COLLATE "C" NOT NULL,
+     session_id   VARCHAR(190) COLLATE "C" NOT NULL,
      version      INT          NOT NULL DEFAULT 1,
-     status       VARCHAR(16)  NOT NULL DEFAULT 'pending',
-     tool_name    VARCHAR(190),
-     tool_call_id VARCHAR(190),
+     status       VARCHAR(16) COLLATE "C"  NOT NULL DEFAULT 'pending',
+     tool_name    VARCHAR(190) COLLATE "C",
+     tool_call_id VARCHAR(190) COLLATE "C",
      tool_input   JSONB,
      checkpoint   JSONB        NOT NULL,
      outcome      JSONB,
@@ -90,34 +99,34 @@ export const PG_SCHEMA_STATEMENTS = [
      created_at   BIGINT       NOT NULL,
      decided_at   BIGINT,
      rev          BIGINT       NOT NULL DEFAULT 0,
-     reopen_reason VARCHAR(32),
+     reopen_reason VARCHAR(32) COLLATE "C",
      terminal_at  BIGINT,
-     gate_kind    VARCHAR(32),
-     bound_input_hash VARCHAR(190),
+     gate_kind    VARCHAR(32) COLLATE "C",
+     bound_input_hash VARCHAR(190) COLLATE "C",
      -- pending_steer / pending_steer_queue / pending_steer_rev:队列化后的 durable steering(core 5.14.0
      -- #147)。三列的语义、「为什么队列另起一列而不是覆盖旧列」(滚动升级窗里旧副本的无条件覆盖写)、
      -- 48000 字节预算、以及「为什么另起一个整数 rev 列而不拿 JSON 旧值当 CAS 守卫」的完整由来见 MySQL
      -- 孪生(tidb-pool.ts 同三列的行内注)。PG text 无长度上限,预算由 core 侧统一执法。
-     pending_steer TEXT,
-     pending_steer_queue TEXT,
+     pending_steer TEXT COLLATE "C",
+     pending_steer_queue TEXT COLLATE "C",
      pending_steer_rev BIGINT NOT NULL DEFAULT 0,
-     risk_descriptor TEXT,
+     risk_descriptor TEXT COLLATE "C",
      PRIMARY KEY (token)
    )`,
     `CREATE INDEX IF NOT EXISTS idx_checkpoint_status_deadline ON checkpoint (status, deadline)`,
     `CREATE INDEX IF NOT EXISTS idx_checkpoint_session_status ON checkpoint (session_id, status)`,
     `CREATE TABLE IF NOT EXISTS checkpoint_ctx (
-     session_id VARCHAR(190) NOT NULL,
+     session_id VARCHAR(190) COLLATE "C" NOT NULL,
      ctx        JSONB        NOT NULL,
      updated_at BIGINT       NOT NULL,
      PRIMARY KEY (session_id)
    )`,
     // E18 resume-at anchor map (the PG twin of the TiDB resume_anchor table — eventId→entryId; see tidb-pool.ts).
     `CREATE TABLE IF NOT EXISTS resume_anchor (
-     session_id VARCHAR(64)    NOT NULL,
-     event_id   VARCHAR(64)    NOT NULL,
-     entry_id   VARCHAR(64)    NOT NULL,
-     owner      VARCHAR(190),
+     session_id VARCHAR(64) COLLATE "C"    NOT NULL,
+     event_id   VARCHAR(64) COLLATE "C"    NOT NULL,
+     entry_id   VARCHAR(64) COLLATE "C"    NOT NULL,
+     owner      VARCHAR(190) COLLATE "C",
      created_at TIMESTAMPTZ(3) NOT NULL,
      PRIMARY KEY (session_id, event_id)
    )`,
@@ -125,9 +134,9 @@ export const PG_SCHEMA_STATEMENTS = [
     // Per-session per-toolName approval exemption (the PG twin — see tidb-pool.ts /
     // sema-internal server/docs/design/APPROVAL-SESSION-EXEMPTION.md).
     `CREATE TABLE IF NOT EXISTS approval_exemption (
-     session_id VARCHAR(64)    NOT NULL,
-     tool_name  VARCHAR(190)   NOT NULL,
-     granted_by VARCHAR(190),
+     session_id VARCHAR(64) COLLATE "C"    NOT NULL,
+     tool_name  VARCHAR(190) COLLATE "C"   NOT NULL,
+     granted_by VARCHAR(190) COLLATE "C",
      created_at TIMESTAMPTZ(3) NOT NULL,
      PRIMARY KEY (session_id, tool_name)
    )`,
@@ -135,16 +144,16 @@ export const PG_SCHEMA_STATEMENTS = [
     // key segment hides this from URLs. id = uuidv7 time-ordered PK = keyset cursor; see tidb-pool.ts /
     // send-file-ledger.ts).
     `CREATE TABLE IF NOT EXISTS sendfile_link (
-     id         VARCHAR(64)    NOT NULL,
-     scope      VARCHAR(190)   NOT NULL,
-     bucket     VARCHAR(190)   NOT NULL,
-     object_key VARCHAR(512)   NOT NULL,
-     track      VARCHAR(16)    NOT NULL,
-     filename   VARCHAR(190)   NOT NULL,
+     id         VARCHAR(64) COLLATE "C"    NOT NULL,
+     scope      VARCHAR(190) COLLATE "C"   NOT NULL,
+     bucket     VARCHAR(190) COLLATE "C"   NOT NULL,
+     object_key VARCHAR(512) COLLATE "C"   NOT NULL,
+     track      VARCHAR(16) COLLATE "C"    NOT NULL,
+     filename   VARCHAR(190) COLLATE "C"   NOT NULL,
      byte_len   BIGINT         NOT NULL,
      ttl_sec    BIGINT         NOT NULL,
-     task_id    VARCHAR(64),
-     session_id VARCHAR(64),
+     task_id    VARCHAR(64) COLLATE "C",
+     session_id VARCHAR(64) COLLATE "C",
      created_at TIMESTAMPTZ(3) NOT NULL,
      PRIMARY KEY (id)
    )`,
@@ -153,12 +162,12 @@ export const PG_SCHEMA_STATEMENTS = [
     // [sessionId, principal ?? null])) = a fixed 64-char hash PK; rules JSONB; CAS-versioned tighten-only — see
     // tidb-pool.ts / session-policy-store-sql.ts).
     `CREATE TABLE IF NOT EXISTS session_policy (
-     policy_key CHAR(64)       NOT NULL,
-     session_id VARCHAR(64)    NOT NULL,
+     policy_key CHAR(64) COLLATE "C"       NOT NULL,
+     session_id VARCHAR(64) COLLATE "C"    NOT NULL,
      -- 2c DENORMALIZED principal, carried solely so listBySession can ENUMERATE: policy_key is a one-way
      -- sha256, so the principal is not recoverable from it. Enumeration-only — it is NOT part of the key and
      -- NOT part of the CAS / tighten-only path. NULL = a session-wide (principal-less) policy row.
-     principal  VARCHAR(190),
+     principal  VARCHAR(190) COLLATE "C",
      rules      JSONB          NOT NULL,
      rev        BIGINT         NOT NULL,
      created_at TIMESTAMPTZ(3) NOT NULL,
@@ -169,15 +178,15 @@ export const PG_SCHEMA_STATEMENTS = [
     // E19 rewind-files (the PG twin of the TiDB snapshot_manifest/snapshot_blob; relPath→blob_hash manifest +
     // content-addressed BYTEA blobs; core captureManifest/applyManifest do the walk/restore — see tidb-pool.ts).
     `CREATE TABLE IF NOT EXISTS snapshot_manifest (
-     scope     VARCHAR(64)   NOT NULL,
-     snap_key  VARCHAR(64)   NOT NULL,
-     rel_path  VARCHAR(1024) NOT NULL,
-     blob_hash CHAR(64)      NOT NULL
+     scope     VARCHAR(64) COLLATE "C"   NOT NULL,
+     snap_key  VARCHAR(64) COLLATE "C"   NOT NULL,
+     rel_path  VARCHAR(1024) COLLATE "C" NOT NULL,
+     blob_hash CHAR(64) COLLATE "C"      NOT NULL
    )`,
     `CREATE INDEX IF NOT EXISTS idx_snapshot_manifest_sk ON snapshot_manifest (scope, snap_key)`,
     `CREATE INDEX IF NOT EXISTS idx_snapshot_manifest_blob ON snapshot_manifest (blob_hash)`,
     `CREATE TABLE IF NOT EXISTS snapshot_blob (
-     blob_hash  CHAR(64)       PRIMARY KEY,
+     blob_hash  CHAR(64) COLLATE "C"       PRIMARY KEY,
      byte_len   BIGINT         NOT NULL,
      -- \`bytes\` is NULLABLE and that nullability is LOAD-BEARING, not laxness: a SQL-backend row carries the
      -- bytes inline; a MinIO-backend row keeps ONLY the INDEX (blob_hash, byte_len, created_at) here with
@@ -194,35 +203,35 @@ export const PG_SCHEMA_STATEMENTS = [
     // is TEXT, NOT JSONB — the byte-match contract is "string in, string out" (the store JSON.parses on load); JSONB would
     // make `pg` auto-parse the row back to an object and break the twin's String()→JSON.parse path. See workflow-journal-store-sql.ts.
     `CREATE TABLE IF NOT EXISTS workflow_journal (
-     run_id     VARCHAR(191) NOT NULL,
+     run_id     VARCHAR(191) COLLATE "C" NOT NULL,
      ordinal    INT          NOT NULL,
      -- SVC-2 / CORE-9 audit BLOCKER: cross-tenant resume isolation (the WorkflowJournalStore seam takes a scope
      -- param). NOT NULL DEFAULT '' — a row written without a scope lands in the '' bucket, which is
      -- CROSS-SCOPE-ORPHANED but harmless: a real resume always filters \`WHERE scope = <caller>\`, so '' rows are
      -- never handed to a tenant. Keep the DEFAULT: it is what makes a scope-less write land in that dead bucket
      -- instead of failing or leaking into a real tenant's scope.
-     scope      VARCHAR(190) NOT NULL DEFAULT '',
-     call_key   VARCHAR(255) NOT NULL,
-     result     TEXT         NOT NULL,
+     scope      VARCHAR(190) COLLATE "C" NOT NULL DEFAULT '',
+     call_key   VARCHAR(255) COLLATE "C" NOT NULL,
+     result     TEXT COLLATE "C"         NOT NULL,
      created_at BIGINT       NOT NULL,
      PRIMARY KEY (run_id, ordinal)
    )`,
     // RB-242 / WF2 ([1981] core 拍板 a 形):cross-replica workflow resume admission lease — the PG twin of
     // workflow_resume_claim in tidb-pool.ts (rationale there; TTL = crash backstop only).
     `CREATE TABLE IF NOT EXISTS workflow_resume_claim (
-     source_run_id VARCHAR(191) NOT NULL,
-     scope         VARCHAR(190) NOT NULL,
-     new_run_id    VARCHAR(191) NOT NULL,
+     source_run_id VARCHAR(191) COLLATE "C" NOT NULL,
+     scope         VARCHAR(190) COLLATE "C" NOT NULL,
+     new_run_id    VARCHAR(191) COLLATE "C" NOT NULL,
      claimed_at    BIGINT       NOT NULL,
      PRIMARY KEY (source_run_id, scope)
    )`,
     // P1 (fleet failover): WorkflowRunStore + completion-inbox PG twins (design doc in workflow-run-store-sql.ts).
     // `run` is TEXT not jsonb (node-pg auto-parse would break the shared String()→JSON.parse path).
     `CREATE TABLE IF NOT EXISTS workflow_run (
-     id         VARCHAR(191) NOT NULL,
-     scope      VARCHAR(190) NOT NULL,
-     status     VARCHAR(16)  NOT NULL,
-     run        TEXT         NOT NULL,
+     id         VARCHAR(191) COLLATE "C" NOT NULL,
+     scope      VARCHAR(190) COLLATE "C" NOT NULL,
+     status     VARCHAR(16) COLLATE "C"  NOT NULL,
+     run        TEXT COLLATE "C"         NOT NULL,
      rev        INTEGER      NOT NULL DEFAULT 0,
      created_at BIGINT       NOT NULL,
      ended_at   BIGINT,
@@ -232,17 +241,17 @@ export const PG_SCHEMA_STATEMENTS = [
     `CREATE INDEX IF NOT EXISTS idx_wfrun_scope_status ON workflow_run (scope, status)`,
     `CREATE TABLE IF NOT EXISTS workflow_completion_inbox (
      seq         BIGSERIAL,
-     session_id  VARCHAR(190) NOT NULL,
-     run_id      VARCHAR(191) NOT NULL,
-     owner       VARCHAR(190),
-     status      VARCHAR(16)  NOT NULL,
-     summary     TEXT         NOT NULL,
+     session_id  VARCHAR(190) COLLATE "C" NOT NULL,
+     run_id      VARCHAR(191) COLLATE "C" NOT NULL,
+     owner       VARCHAR(190) COLLATE "C",
+     status      VARCHAR(16) COLLATE "C"  NOT NULL,
+     summary     TEXT COLLATE "C"         NOT NULL,
      enqueued_at BIGINT       NOT NULL,
      -- 1.109 delivery envelope. kind NULL = a LEGACY \`workflow_complete\` row (the shape that predates the
      -- envelope); readers must keep treating NULL as that kind, it is not "unknown". payload = the kind's
      -- body, NULL for the legacy shape.
-     kind        VARCHAR(24),
-     payload     TEXT,
+     kind        VARCHAR(24) COLLATE "C",
+     payload     TEXT COLLATE "C",
      PRIMARY KEY (session_id, run_id),
      -- Twin-alignment with TiDB's \`UNIQUE KEY uq_wfinbox_seq (seq)\` (same constraint name on purpose, so the two
      -- schemas can be diffed by name). This is NOT a correctness fix: seq is BIGSERIAL, so it is already unique in
@@ -254,10 +263,10 @@ export const PG_SCHEMA_STATEMENTS = [
    )`,
     `CREATE INDEX IF NOT EXISTS idx_wfinbox_session_seq ON workflow_completion_inbox (session_id, seq)`,
     `CREATE TABLE IF NOT EXISTS workflow_inbox_fence (
-     session_id  VARCHAR(190) NOT NULL,
-     kind        VARCHAR(8)   NOT NULL,
-     run_id      VARCHAR(191) NOT NULL DEFAULT '',
-     owner       VARCHAR(190),
+     session_id  VARCHAR(190) COLLATE "C" NOT NULL,
+     kind        VARCHAR(8) COLLATE "C"   NOT NULL,
+     run_id      VARCHAR(191) COLLATE "C" NOT NULL DEFAULT '',
+     owner       VARCHAR(190) COLLATE "C",
      owner_known SMALLINT     NOT NULL DEFAULT 0,
      until_ms    BIGINT       NOT NULL,
      PRIMARY KEY (session_id, kind, run_id)
@@ -265,11 +274,11 @@ export const PG_SCHEMA_STATEMENTS = [
     `CREATE INDEX IF NOT EXISTS idx_wffence_until ON workflow_inbox_fence (until_ms)`,
     // 1.108 review fix (lens③ HIGH): notify-journal PG twin (design note in tidb-pool.ts).
     `CREATE TABLE IF NOT EXISTS workflow_notify_journal (
-     run_id         VARCHAR(191) NOT NULL,
-     scope          VARCHAR(190) NOT NULL,
+     run_id         VARCHAR(191) COLLATE "C" NOT NULL,
+     scope          VARCHAR(190) COLLATE "C" NOT NULL,
      acked          SMALLINT     NOT NULL DEFAULT 0,
-     source_task_id VARCHAR(191),
-     principal      VARCHAR(190),
+     source_task_id VARCHAR(191) COLLATE "C",
+     principal      VARCHAR(190) COLLATE "C",
      created_at     BIGINT       NOT NULL,
      acked_at       BIGINT,
      PRIMARY KEY (run_id)

package/dist/plugins/pg-rate-limiter.js

@@ -1,6 +1,6 @@
 import { PgWriteBehindCounter } from "./write-behind-counter.js";
 /** The counter's table binding for the per-key request rate limit (mirror of the TiDB twin's binding). */
-const RATE_LIMIT_TABLE = { table: "rate_limit", keyCol: "limit_key", valCol: "n" };
+const RATE_LIMIT_TABLE = { table: "rate_limit", keyCol: "limit_key", valCol: "hits" };
 export class PgRateLimiter {
     limit;
     counter;
@@ -43,9 +43,9 @@ export class PgRateLimiter {
  */
 export const PG_RATE_LIMITER_SCHEMA = [
     `CREATE TABLE IF NOT EXISTS rate_limit (
-     limit_key     VARCHAR(190)   NOT NULL,
+     limit_key     VARCHAR(190) COLLATE "C"   NOT NULL,
      window_bucket BIGINT         NOT NULL,
-     n             INTEGER        NOT NULL DEFAULT 0,
+     hits             INTEGER        NOT NULL DEFAULT 0,
      updated_at    TIMESTAMPTZ(3) NOT NULL,
      PRIMARY KEY (limit_key, window_bucket)
    )`,

package/dist/plugins/pg-session-storage.d.ts

@@ -4,7 +4,7 @@ import type { SessionSummary } from "./store-contracts.js";
 import { type StagingHandle } from "../session-sync-kernel.js";
 /**
  * PG-dialect DDL for the L1 session log, translated from tidb-pool.ts SCHEMA_STATEMENTS:
- * JSON→JSONB, DATETIME(3)→TIMESTAMPTZ(3), inline `KEY`/`UNIQUE KEY`→separate CREATE INDEX (UNIQUE for uk_entry).
+ * JSON→JSONB, DATETIME(3)→TIMESTAMPTZ(3), inline `KEY`/`UNIQUE KEY`→separate CREATE INDEX (UNIQUE for uq_session_event_entry).
  *
  * SCHEMA POLICY: see the header of pg-pool.ts — the code is the single source of truth, schema changes are
  * drop-and-recreate, and NO new `ALTER TABLE` seams are added here; fold into the CREATE instead.

package/dist/plugins/pg-session-storage.js

@@ -24,9 +24,8 @@ import { escapeLike } from "./sql-escape.js";
 import { pgSafeJsonStringify } from "./pg-safe-json.js";
 import { toIso } from "./sql-row-helpers.js";
 import { contentForkRelation, fastForwardSharedContentDiverged } from "../session-sync-content.js";
-import { classifySyncRelationshipByIds, SyncConflictError, stagingIdFor, STAGING_ID_MARKER, } from "../session-sync-kernel.js";
-/** Staging-row reaper grace window (twin of the TiDB store's STAGING_GC_GRACE_MS) — see that store for the rationale. */
-const STAGING_GC_GRACE_MS = 3_600_000;
+import { classifySyncRelationshipByIds, SyncConflictError, stagingIdFor, STAGING_ID_MARKER, STAGING_GC_GRACE_MS, // 两孪生店同源(理由见 kernel 处顶注)
+ } from "../session-sync-kernel.js";
 function isDupKey(err) {
     return Boolean(err) && err.code === "23505"; // PG unique_violation
 }
@@ -36,36 +35,36 @@ function parseEntry(p) {
 }
 /**
  * PG-dialect DDL for the L1 session log, translated from tidb-pool.ts SCHEMA_STATEMENTS:
- * JSON→JSONB, DATETIME(3)→TIMESTAMPTZ(3), inline `KEY`/`UNIQUE KEY`→separate CREATE INDEX (UNIQUE for uk_entry).
+ * JSON→JSONB, DATETIME(3)→TIMESTAMPTZ(3), inline `KEY`/`UNIQUE KEY`→separate CREATE INDEX (UNIQUE for uq_session_event_entry).
  *
  * SCHEMA POLICY: see the header of pg-pool.ts — the code is the single source of truth, schema changes are
  * drop-and-recreate, and NO new `ALTER TABLE` seams are added here; fold into the CREATE instead.
  */
 export const PG_SESSION_SCHEMA = [
     `CREATE TABLE IF NOT EXISTS session_meta (
-     session_id  VARCHAR(64)  NOT NULL,
-     owner       VARCHAR(190),
+     session_id  VARCHAR(64) COLLATE "C"  NOT NULL,
+     owner       VARCHAR(190) COLLATE "C",
      created_at  TIMESTAMPTZ(3) NOT NULL,
      updated_at  TIMESTAMPTZ(3) NOT NULL,
-     leaf_id     VARCHAR(64),
+     leaf_id     VARCHAR(64) COLLATE "C",
      leaf_seq    BIGINT       NOT NULL DEFAULT 0,
      -- Write-once auto-title (setTitleIfNull / probeTitle): NULL = "untitled", i.e. still claimable; the
      -- three-state probe distinguishes it from "no such session". PG twin of the TiDB COLUMN_MIGRATIONS leg.
-     title       VARCHAR(120),
+     title       VARCHAR(120) COLLATE "C",
      PRIMARY KEY (session_id)
    )`,
     `CREATE INDEX IF NOT EXISTS idx_session_meta_owner ON session_meta (owner)`,
     `CREATE TABLE IF NOT EXISTS session_event (
-     session_id  VARCHAR(64) NOT NULL,
+     session_id  VARCHAR(64) COLLATE "C" NOT NULL,
      seq         BIGINT      NOT NULL,
-     entry_id    VARCHAR(64) NOT NULL,
-     parent_id   VARCHAR(64),
-     type        VARCHAR(32) NOT NULL,
+     entry_id    VARCHAR(64) COLLATE "C" NOT NULL,
+     parent_id   VARCHAR(64) COLLATE "C",
+     type        VARCHAR(32) COLLATE "C" NOT NULL,
      payload     JSONB       NOT NULL,
      ts          TIMESTAMPTZ(3) NOT NULL,
      PRIMARY KEY (session_id, seq)
    )`,
-    `CREATE UNIQUE INDEX IF NOT EXISTS uk_session_event_entry ON session_event (session_id, entry_id)`,
+    `CREATE UNIQUE INDEX IF NOT EXISTS uq_session_event_entry ON session_event (session_id, entry_id)`,
 ];
 /** Idempotent schema apply for this store's tables (the test calls this; production aggregation is separate). */
 export async function ensureSchema(pool) {

package/dist/plugins/remote-env-host.js

@@ -49,7 +49,9 @@ import { resolveHostShell, hostShell, spawnGroupOptions, killTreeHard, killTreeS
 import { BackgroundShellManager, seedMemStream, feedMemStream, drainMemStream } from "./background-shell-support.js";
 import { FileError, ExecutionError, RemoteExecutionError, scrubSecretEnv, RollingTailBuffer, markTruncated, SchedulerError, BackgroundShellError, } from "@sema-agent/core";
 const PROVIDER = "host";
-/** Default per-command wall-clock when the caller passes none (NOT a hang detector — host commands rarely hang). */
+/** Default per-command wall-clock when the caller passes none (NOT a hang detector — host commands rarely hang).
+ *  ⚠️ 同判据三腿之一(另两条:`remote-env-local-docker.ts` 同值 30min、`remote-env-ssh.ts` **5min**)——
+ *  分歧成文与候裁说明写在 ssh 那处的 `commandTimeoutMs` 顶注(#176 二轮扫描 finding)。 */
 const DEFAULT_COMMAND_TIMEOUT_MS = 30 * 60_000;
 // ─── design/103 host-lane background shell: TOC's run_in_background / BashOutput / KillShell ───
 // host driver = design/103 §5.2 path ①: a `detached` child (its OWN process group via `detached:true` → pgid ===

package/dist/plugins/remote-env-local-docker.js

@@ -22,8 +22,9 @@
  *    snapshot to resume from, so a dead container cannot be re-attached.
  *
  * 🔴 **Domestic-images iron rule (clay):** the base `image` comes ENTIRELY from config (no hardcoded
- * `docker.io/...` default). A deployment points it at the sandbox-image-pool (docker.io/claybobby public pool;
- * CN fallback = in-network Gitea registry — SWR deprecated 2026-07-13). This adapter never invents a registry.
+ * `docker.io/...` default). A deployment points it at the sandbox-image-pool (docker.io/claybobby public pool)
+ * or its own private registry — SWR was deprecated 2026-07-13 and the in-network Gitea registry container was
+ * retired 2026-08 (no CN fallback is baked in). This adapter never invents a registry.
  *
  * 🔴 **argv anti-injection (council, host/ssh §4):** every `docker` invocation is a `spawn(binary, argv[])`
  * with NO host-side shell (`shell:false` default) — the container id, image, paths, and env values are
@@ -49,7 +50,9 @@ import { createPosixShellFs } from "./posix-shell-fs.js";
 const PROVIDER = "local-docker";
 /** Default workspace root INSIDE the container (the agent's tools resolve relative paths against it). */
 const DEFAULT_MOUNT_PATH = "/workspace";
-/** Per-command wall-clock when the caller passes none (a single exec bound, NOT the container lifetime). */
+/** Per-command wall-clock when the caller passes none (a single exec bound, NOT the container lifetime).
+ *  ⚠️ 同判据三腿之一(另两条:`remote-env-host.ts` 同值 30min、`remote-env-ssh.ts` **5min**)——分歧成文
+ *  与候裁说明写在 ssh 那处的 `commandTimeoutMs` 顶注(#176 二轮扫描 finding)。 */
 const DEFAULT_COMMAND_TIMEOUT_MS = 30 * 60_000;
 /** Wall-clock for a control-plane docker op (run/rm/inspect/cp) — should be fast; a hang surfaces typed. */
 const DEFAULT_CONTROL_TIMEOUT_MS = 60_000;

package/dist/plugins/remote-env-ssh.d.ts

@@ -11,7 +11,19 @@ export interface SshEnvConfig {
     mountPath?: string;
     /** Connect handshake bound (ms). */
     readyTimeoutMs?: number;
-    /** Per-command wall-clock bound (ms) when the caller gives none — NOT the connection lifetime. */
+    /**
+     * Per-command wall-clock bound (ms) when the caller gives none — NOT the connection lifetime.
+     *
+     * ⚠️ **值与孪生腿不一致,原因未成文**(2026-08-08,#176 二轮扫描 finding,**候裁**):本腿默认
+     * `5 * 60_000`(见构造处),而同判据的另外两条腿 —— `remote-env-host.ts` / `remote-env-local-docker.ts`
+     * 的 `DEFAULT_COMMAND_TIMEOUT_MS` —— 都是 `30 * 60_000`,JSDoc 措辞还逐字同源。三处无共享常量、无对表
+     * 钉,ssh 这一处也没有任何注释说明 5min 是刻意收紧(git 史是 history-free snapshot,「30min 是后来调
+     * 参、ssh 漏调」的假说无从验证)。后果:一条跑满 6 分钟的构建命令在 host/docker 腿上正常收尾、在 ssh
+     * 腿上被判超时,而两腿都「按自己的默认值」正确工作。
+     * (`remote-env-k8s.ts` 的 30min **不属**同判据 —— 那是 pod 的 `activeDeadlineSeconds`,env 寿命,
+     *  与 e2b sandbox lifetime 同族,别把它数进来。)
+     * 取哪个值是行为面决定 ⇒ 留给属主裁,本批只把分歧成文,不动值。
+     */
     commandTimeoutMs?: number;
     /** File-transfer (sftp) bound (ms). */
     dataTimeoutMs?: number;

package/dist/plugins/roster-store-sql.js

@@ -76,7 +76,7 @@ export async function ensureTiDBRosterSchema(pool) {
     -- owner/scope:core 1.365 BREAKING 双轴必填(default-deny 谓词的两根轴;顶注 ① 记了曾 nullable 的由来)
     owner VARCHAR(190) NOT NULL,
     scope VARCHAR(190) NOT NULL,
-    session_scoped TINYINT NULL,
+    session_scoped TINYINT(1) NULL,
     -- core 1.367 δ(additive):RosterEntry.rootSessionId verbatim 存(枚举/恢复读者;谓词暂无臂)
     root_session_id VARCHAR(190) NULL,
     -- core 1.373 additive:spawn 记录的解析后模型 id(NULL = 该 spawn 未记录模型)
@@ -96,20 +96,20 @@ export async function ensurePgRosterSchema(q) {
     name_key VARCHAR(190) COLLATE "C" NOT NULL,
     owner_key VARCHAR(190) COLLATE "C" NOT NULL,
     scope_key VARCHAR(190) COLLATE "C" NOT NULL,
-    name VARCHAR(190) NOT NULL,
-    agent_id VARCHAR(190) NOT NULL,
-    session_id VARCHAR(190),
-    tool_use_id VARCHAR(190),
+    name VARCHAR(190) COLLATE "C" NOT NULL,
+    agent_id VARCHAR(190) COLLATE "C" NOT NULL,
+    session_id VARCHAR(190) COLLATE "C",
+    tool_use_id VARCHAR(190) COLLATE "C",
     -- owner/scope:core 1.365 BREAKING 双轴必填(TiDB 同案;曾 nullable 的由来见两 ensure 上方顶注 ①)
     owner VARCHAR(190) COLLATE "C" NOT NULL,
     scope VARCHAR(190) COLLATE "C" NOT NULL,
     session_scoped SMALLINT,
     -- core 1.367 δ(additive,TiDB 同案):RosterEntry.rootSessionId verbatim 存
-    root_session_id VARCHAR(190),
+    root_session_id VARCHAR(190) COLLATE "C",
     -- core 1.373 additive(TiDB 同案):解析后模型 id(NULL = 该 spawn 未记录模型)
-    model VARCHAR(190),
+    model VARCHAR(190) COLLATE "C",
     -- core 5.10.0 additive(TiDB 同案):modelFallback 归因
-    model_fallback VARCHAR(64),
+    model_fallback VARCHAR(64) COLLATE "C",
     created_at_ms BIGINT NOT NULL,
     recorded_at_ms BIGINT NOT NULL,
     PRIMARY KEY (name_key, owner_key, scope_key)

package/dist/plugins/store-contracts.d.ts

@@ -40,6 +40,25 @@ export interface RunRecord {
     createdAt: string;
     updatedAt: string;
 }
+/**
+ * 「这一行已经走到**终局**了吗」——`RunRecord["status"]`(= `"running" | TaskStatus`)的**穷举**判据,
+ * 与类型定义同住一个文件(词表的属主 = 判据的属主)。
+ *
+ * 🔴 为什么是 `switch` 而不是一张 `ReadonlySet<string>`(2026-08-08,#176 二轮扫描 finding):终局词表
+ * **真变过**(core 5.8.0 把 `"timeout"` 从 `TaskStatus` 里删了)。而集合形的门对象是 `string`,对词表
+ * 两个方向都无钉:
+ *   · **增词**(core 新加一个终局态)⇒ 集合不含它 ⇒ 该行被静默判成「非终局」,收敛器会一直等一个
+ *     永远不会再动的行;
+ *   · **删词** ⇒ 集合里留一个死字面量,没有任何东西会说话。
+ * 穷举 `switch` 把两个方向都变成**编译期**问题:core 加成员 ⇒ `default` 臂收不敛到 `never` ⇒ tsc 红,
+ * 加成员的人被迫当场回答「这个新态算不算终局」;删成员 ⇒ 对应 `case` 变成不可达字面量、同样红。
+ * 这条判据不许再被手抄成第二份 —— 两个消费点(`approval-reconciler.ts` 判据 2、`http/routes/runs.ts`
+ * 的取消后复读)都从这里取。
+ *
+ * 词表现状:终局 = completed / failed / blocked;非终局 = running / suspended / needs_review
+ * (suspended 与 needs_review 都还能再动,`running` 更不必说)。
+ */
+export declare function isTerminalRunStatus(status: RunRecord["status"]): boolean;
 /** One row of the GET /v1/sessions list (CC /resume picker): a DISTINCT session (sessionId) aggregated from its
  *  task_run rows — newest-first by last activity. The preview/status are the LATEST run's ("continue where I left
  *  off"); the counts/timestamps span the whole session. Owner included so a fleet-wide (ops) listing is attributable. */

package/dist/plugins/store-contracts.js

@@ -1,4 +1,46 @@
 import { parseJsonOr, toIso as iso, normalizeIsoOrNull as isoOrNull } from "./sql-row-helpers.js";
+/**
+ * 「这一行已经走到**终局**了吗」——`RunRecord["status"]`(= `"running" | TaskStatus`)的**穷举**判据,
+ * 与类型定义同住一个文件(词表的属主 = 判据的属主)。
+ *
+ * 🔴 为什么是 `switch` 而不是一张 `ReadonlySet<string>`(2026-08-08,#176 二轮扫描 finding):终局词表
+ * **真变过**(core 5.8.0 把 `"timeout"` 从 `TaskStatus` 里删了)。而集合形的门对象是 `string`,对词表
+ * 两个方向都无钉:
+ *   · **增词**(core 新加一个终局态)⇒ 集合不含它 ⇒ 该行被静默判成「非终局」,收敛器会一直等一个
+ *     永远不会再动的行;
+ *   · **删词** ⇒ 集合里留一个死字面量,没有任何东西会说话。
+ * 穷举 `switch` 把两个方向都变成**编译期**问题:core 加成员 ⇒ `default` 臂收不敛到 `never` ⇒ tsc 红,
+ * 加成员的人被迫当场回答「这个新态算不算终局」;删成员 ⇒ 对应 `case` 变成不可达字面量、同样红。
+ * 这条判据不许再被手抄成第二份 —— 两个消费点(`approval-reconciler.ts` 判据 2、`http/routes/runs.ts`
+ * 的取消后复读)都从这里取。
+ *
+ * 词表现状:终局 = completed / failed / blocked;非终局 = running / suspended / needs_review
+ * (suspended 与 needs_review 都还能再动,`running` 更不必说)。
+ */
+export function isTerminalRunStatus(status) {
+    switch (status) {
+        case "completed":
+        case "failed":
+        case "blocked":
+            return true;
+        case "running":
+        case "suspended":
+        case "needs_review":
+            return false;
+        default: {
+            // core 的 `TaskStatus` 出了新成员 ⇒ 这里收不敛到 never ⇒ tsc 红(整条判据的**编译期**执行点)。
+            const unhandled = status;
+            // 🔴 运行时**必须**照旧返回 false(#176 codex R1 真缺陷,红先复现):`never` 只活在编译期,
+            // `return unhandled` 在运行时返回的是那个字符串本身 = **truthy**。而 `plugins/run-store-sql.ts` 的
+            // rowToRun 把无约束的 SQL 文本列**裸 cast** 成本联合 ⇒ 滚动升级里一个更新的副本写入的新状态词
+            // 会被这里读到。判成「终局」的代价不可逆:approval-reconciler 判据 2 会把一张还活着的 ask 永久
+            // 打成 DENIED/routing_failure,取消路由也会把这一行当终局上报。未知 ⇒ 保守判**非终局**(落 hold,
+            // 下一轮重试),与本函数取代的那份 `ReadonlySet<string>.has()` 逐字节同行为。
+            void unhandled;
+            return false;
+        }
+    }
+}
 /** SELECT row → {@link BakeRecord} — shared by BOTH SQL twins (design/158 S8 归位, A3 沉底). */
 export function mapBakeRow(r) {
     return {

package/dist/plugins/task-attachment-store.js

@@ -87,14 +87,14 @@ export async function ensureTiDBTaskAttachmentSchema(pool) {
 }
 export async function ensurePgTaskAttachmentSchema(q) {
     await q(`CREATE TABLE IF NOT EXISTS ${TASK_ATTACHMENT_TABLE} (
-    id VARCHAR(64) NOT NULL,
+    id VARCHAR(64) COLLATE "C" NOT NULL,
     -- owner:隔离键,'=' 必须字节等价(bga F2 同姿)
     owner VARCHAR(190) COLLATE "C" NOT NULL,
-    name VARCHAR(255) NOT NULL,
-    mime VARCHAR(128) NOT NULL,
-    sha256 CHAR(64) NOT NULL,
+    name VARCHAR(255) COLLATE "C" NOT NULL,
+    mime VARCHAR(128) COLLATE "C" NOT NULL,
+    sha256 CHAR(64) COLLATE "C" NOT NULL,
     size_bytes INT NOT NULL,
-    session_id VARCHAR(190),
+    session_id VARCHAR(190) COLLATE "C",
     created_at_ms BIGINT NOT NULL,
     bound_at_ms BIGINT,
     PRIMARY KEY (id)

package/dist/plugins/task-list-store-sql.js

@@ -51,7 +51,7 @@ export async function ensurePgTaskListSchema(q) {
     id VARCHAR(190) COLLATE "C" NOT NULL,
     id_num BIGINT,
     sort_seq BIGINT NOT NULL,
-    item_json TEXT NOT NULL,
+    item_json TEXT COLLATE "C" NOT NULL,
     PRIMARY KEY (list_key, id)
   )`);
 }

package/dist/plugins/tidb-cost-quota.js

@@ -4,7 +4,7 @@ export class TiDBCostQuota {
     counter;
     constructor(pool, limitMicroUsd, windowMs, now, onDegraded, queryTimeoutMs) {
         this.limitMicroUsd = limitMicroUsd;
-        this.counter = new WriteBehindCounter(pool, { table: "cost_quota", keyCol: "scope_key", valCol: "micro" }, windowMs, now, onDegraded, queryTimeoutMs);
+        this.counter = new WriteBehindCounter(pool, { table: "cost_quota", keyCol: "scope_key", valCol: "micro_usd" }, windowMs, now, onDegraded, queryTimeoutMs);
     }
     check(scopeKey) {
         const used = this.counter.used(scopeKey);