fix(schedules): refresh untouched builtin config so checks get new capabilities

Built-in agent checks kept the config stored at first registration, so
check.pending never received decision.list / subscription.list added in
AG-3 and the patrol could not read pending items (REAL-2 scenario g).
Track config_customized (migration 0045); sync replaces config with the
code default unless the user PATCHed it. Needs image rebuild.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

packages/contracts/test/db-sync.test.ts

@@ -108,8 +108,12 @@ const ROWS: Record<string, { row: Obj; dbOnly?: string[]; apiOnly?: string[] }>
   SlotDeferral: { row: C.SlotDeferral },
   SlotUnit: { row: C.SlotUnit },
   SubscriptionHistory: { row: C.SubscriptionHistory },
-  // W7-C 定时任务(0028):board_group 在 API 里叫 group;default_enabled 只用于"恢复默认"
-  ScheduledJob: { row: C.ScheduledJob, dbOnly: ["boardGroup", "defaultEnabled"], apiOnly: ["group"] },
+  // W7-C 定时任务(0028):board_group 在 API 里叫 group;default_enabled 只用于"恢复默认";config_customized(0045)只供启动同步
+  ScheduledJob: {
+    row: C.ScheduledJob,
+    dbOnly: ["boardGroup", "defaultEnabled", "configCustomized"],
+    apiOnly: ["group"],
+  },
   ScheduledJobRun: { row: C.ScheduledJobRun },
   // W7-A Pi 上游(0027):secret_ref 不出 API
   // 0044 远程模型表:经 GET /pi/upstreams/{id}/models 单独返回,不进上游行

packages/db/migrations/0045_scheduled_job_config_customized.ts

@@ -0,0 +1,23 @@
+import type { Kysely } from "kysely";
+import { execDdl } from "../src/migration-helpers.ts";
+
+// 内置定时任务的 config 只在用户改过(PATCH config)时保留表内值;没改过的行在启动同步时整体换成代码默认值,
+// 否则代码新增的默认项(如巡检白名单新增的 decision.list / subscription.list)永远进不了旧行。
+// 已有行:内置巡检的白名单与 0.2.2 默认值不同的视为用户改过。
+
+// biome-ignore lint/suspicious/noExplicitAny: 迁移不依赖应用表类型
+export async function up(db: Kysely<any>): Promise<void> {
+  await execDdl(
+    db,
+    `alter table scheduled_job add column config_customized boolean not null default false;
+     update scheduled_job set config_customized = true
+      where not builtin
+         or (kind = 'agent_check' and config->'capabilityAllowlist' is distinct from
+             '["catalog.lookup","release.search","release.inspect","inventory.query","task.inspect","identity.resolve"]'::jsonb);`,
+  );
+}
+
+// biome-ignore lint/suspicious/noExplicitAny: 同上
+export async function down(db: Kysely<any>): Promise<void> {
+  await execDdl(db, `alter table scheduled_job drop column if exists config_customized;`);
+}

packages/db/src/types.ts

@@ -1265,6 +1265,7 @@ export interface ScheduledJobTable {
   schedule: Json;
   default_schedule: Json;
   customized: Generated<boolean>;
+  config_customized: Generated<boolean>;
   config: Generated<Json>;
   last_run_at: Timestamptz | null;
   last_status: ScheduledJobLastStatus | null;