fix(persistence): address 22 review comments from CodeQL, Copilot, and Code Quality

Bug fixes:
- Sanitize log params to prevent log injection (CodeQL)
- Reset threads_meta.status to idle/error when run completes
- Attach messages only to latest checkpoint in /history response
- Write threads_meta on POST /threads so new threads appear in search

Lint fixes:
- Remove unused imports (journal.py, migrations/env.py, test_converters.py)
- Convert lambda to named function (engine.py, Ruff E731)
- Remove unused logger definitions in repos (Ruff F841)
- Add logging to JSONL decode errors and empty except blocks
- Separate assert side-effects in tests (CodeQL)
- Remove unused local variables in tests (Ruff F841)
- Fix max_trace_content truncation to use byte length, not char length

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

backend/packages/harness/deerflow/persistence/engine.py

@@ -10,13 +10,15 @@ None and fall back to in-memory implementations.
 
 from __future__ import annotations
 
-import logging
-
 import json
+import logging
 
 from sqlalchemy.ext.asyncio import AsyncEngine, AsyncSession, async_sessionmaker, create_async_engine
 
-_json_serializer = lambda obj: json.dumps(obj, ensure_ascii=False)
+
+def _json_serializer(obj: object) -> str:
+    """JSON serializer with ensure_ascii=False for Chinese character support."""
+    return json.dumps(obj, ensure_ascii=False)
 
 logger = logging.getLogger(__name__)
 
@@ -106,7 +108,9 @@ async def init_engine(
     try:
         import deerflow.persistence.models  # noqa: F401
     except ImportError:
-        pass
+        # Models package not yet available — tables won't be auto-created.
+        # This is expected during initial scaffolding or minimal installs.
+        logger.debug("deerflow.persistence.models not found; skipping auto-create tables")
 
     try:
         async with _engine.begin() as conn:

backend/packages/harness/deerflow/persistence/migrations/env.py

@@ -8,6 +8,7 @@ have their own schema lifecycle and must not be touched by Alembic.
 from __future__ import annotations
 
 import asyncio
+import logging
 from logging.config import fileConfig
 
 from alembic import context
@@ -17,9 +18,13 @@ from deerflow.persistence.base import Base
 
 # Import all models so metadata is populated.
 try:
-    import deerflow.persistence.models  # noqa: F401
+    import deerflow.persistence.models  # noqa: F401 — register ORM models with Base.metadata
 except ImportError:
-    pass
+    # Models not available — migration will work with existing metadata only.
+    logging.getLogger(__name__).warning(
+        "Could not import deerflow.persistence.models; "
+        "Alembic may not detect all tables"
+    )
 
 config = context.config
 if config.config_file_name is not None:

backend/packages/harness/deerflow/persistence/repositories/feedback_repo.py

@@ -5,7 +5,6 @@ Each method acquires its own short-lived session.
 
 from __future__ import annotations
 
-import logging
 import uuid
 from datetime import UTC, datetime
 
@@ -14,8 +13,6 @@ from sqlalchemy.ext.asyncio import AsyncSession, async_sessionmaker
 
 from deerflow.persistence.models.feedback import FeedbackRow
 
-logger = logging.getLogger(__name__)
-
 
 class FeedbackRepository:
     def __init__(self, session_factory: async_sessionmaker[AsyncSession]) -> None:

backend/packages/harness/deerflow/persistence/repositories/run_repo.py

@@ -8,7 +8,6 @@ minutes -- we don't hold connections across long execution.
 from __future__ import annotations
 
 import json
-import logging
 from datetime import UTC, datetime
 from typing import Any
 
@@ -18,8 +17,6 @@ from sqlalchemy.ext.asyncio import AsyncSession, async_sessionmaker
 from deerflow.persistence.models.run import RunRow
 from deerflow.runtime.runs.store.base import RunStore
 
-logger = logging.getLogger(__name__)
-
 
 class RunRepository(RunStore):
     def __init__(self, session_factory: async_sessionmaker[AsyncSession]) -> None:

backend/packages/harness/deerflow/persistence/repositories/thread_meta_repo.py

@@ -2,7 +2,6 @@
 
 from __future__ import annotations
 
-import logging
 from datetime import UTC, datetime
 from typing import Any
 
@@ -11,8 +10,6 @@ from sqlalchemy.ext.asyncio import AsyncSession, async_sessionmaker
 
 from deerflow.persistence.models.thread_meta import ThreadMetaRow
 
-logger = logging.getLogger(__name__)
-
 
 class ThreadMetaRepository:
     def __init__(self, session_factory: async_sessionmaker[AsyncSession]) -> None: