fix: strip trailing semicolons from LLM-generated SQL and add SQL-route fallback

Two bugs prevented SQL retrieval from working:

1. LLMs append trailing semicolons to SQL (~90%% of the time).
_validate_sql() rejected these as potential injection attacks.
Fix: rstrip(';') before validation (internal semicolons still blocked).

2. When route=sql and the LLM SQL query failed, the keyword-based
SQL fallback never triggered (condition excluded route=sql).
Fix: expanded fallback to build fresh keyword query for route=sql.

Verified end-to-end: China PTS scores now returns 49 rows (was 0).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/retriever.py

@@ -259,12 +259,29 @@ def retrieve(
     if route in ("vector", "both") or (route == "sql" and not sql_rows):
         db_results = retrieve_from_vectordb(query, cfg)
 
-    # ── Fallback: vector found nothing, try SQL ──────────────────────
-    if sql_enabled and not db_results and not sql_rows and route in ("vector", "both"):
-        if not sql_query:
-            sql_query = _build_fallback_sql_query(query, cfg)
-        if sql_query:
-            sql_rows, sql_context = _run_sql_retrieval(sql_query, cfg)
+    # ── Fallback: try keyword-based SQL when primary path returned nothing ─
+    #   - route "vector"/"both": vector found nothing → try SQL keyword search
+    #   - route "sql": LLM SQL query failed → try SQL keyword search as last resort
+    sql_fallback_needed = (
+        sql_enabled
+        and not sql_rows
+        and (
+            (route in ("vector", "both") and not db_results)
+            or route == "sql"
+        )
+    )
+    if sql_fallback_needed:
+        if route == "sql":
+            # LLM-generated sql_query already failed; build a fresh keyword query
+            fallback_query = _build_fallback_sql_query(query, cfg)
+            if fallback_query:
+                sql_rows, sql_context = _run_sql_retrieval(fallback_query, cfg)
+        else:
+            # route is "vector" or "both" — existing fallback logic
+            if not sql_query:
+                sql_query = _build_fallback_sql_query(query, cfg)
+            if sql_query:
+                sql_rows, sql_context = _run_sql_retrieval(sql_query, cfg)
 
     # ── Web search ───────────────────────────────────────────────────
     web_enabled = cfg.get("web_search", {}).get("enabled", False)

src/sql_retriever.py

@@ -73,6 +73,11 @@ def execute_sql_query(sql_query: str, cfg: dict) -> list[dict]:
     # Strip comments before validation AND execution
     sql_query = _strip_sql_comments(sql_query).strip()
 
+    # Strip trailing semicolons — LLMs add them ~90% of the time.
+    # Must happen AFTER comment removal but BEFORE validation, so that
+    # _validate_sql() still rejects internal semicolons (statement chaining).
+    sql_query = sql_query.rstrip(";").rstrip()
+
     if not _validate_sql(sql_query):
         return []