audit fixes (P7): make the maintenance scripts refuse by default instead of mutating by default

.gitignore

@@ -129,8 +129,9 @@ __pycache__/
 # vercel
 .vercel
 
-# supabase local CLI state
+# supabase local CLI state (per-machine; the CLI's own scaffold ignores both)
 supabase/.temp/
+supabase/.branches/
 
 # typescript
 *.tsbuildinfo
@@ -169,7 +170,10 @@ ds-bundle/
 # esbuild output for the worker image (scripts/build-worker.mjs)
 dist/
 test-output*.txt
+# Downloaded staging tenancy CI artifacts are disposable; the one committed evidence
+# document (run 29795051547) is a tracked repository file and must not be ignored.
 docs/archive/staging-tenancy-evidence-*
+!docs/archive/staging-tenancy-evidence-29795051547/
 
 # Subagent-driven-development coordination scratch (ledger, briefs, review packages)
 .superpowers/

caring-contacts/run-db-tests.mjs

@@ -10,42 +10,75 @@
 // this schema exists to prove would then be unproven and reported green.
 //
 // The database is a local, disposable container. It is NOT the repository's live Supabase
-// project, and nothing here touches a hosted service.
+// project, and nothing here touches a hosted service. Two controls keep it that way:
+//   - the URL must name a loopback host (127.0.0.1, ::1 or localhost), or this runner refuses;
+//   - the offline test environment applied by scripts/run-vitest.mjs blanks the variable unless
+//     CARING_CONTACTS_DB_TESTS=1 is set, which only this runner sets. A plain `npm run test` in a
+//     shell that still exports the URL therefore never collects the destructive project.
 import { spawn } from "node:child_process";
 import path from "node:path";
-import { fileURLToPath } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 
-const VARIABLE = "CARING_CONTACTS_DATABASE_URL";
+import {
+  CARING_CONTACTS_DATABASE_URL_KEY,
+  CARING_CONTACTS_DB_TESTS_OPT_IN,
+  caringContactsDatabaseHostProblem,
+} from "../scripts/test-environment.mjs";
+
+const VARIABLE = CARING_CONTACTS_DATABASE_URL_KEY;
 const projectRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 
-const url = process.env[VARIABLE];
-if (typeof url !== "string" || url.trim() === "") {
-  const lines = [
-    `${VARIABLE} is not set, so the caring-contact database suites cannot run.`,
-    "They are never skipped: row-level security is the control that stops one hospital team",
-    "seeing another team's patients, and it is only proven against a real database.",
-    "",
-    "Start a disposable local Postgres and point the variable at it, for example:",
-    "  docker run --rm -d --name caring-contacts-pg -e POSTGRES_PASSWORD=caring-contacts-local -p 54329:5432 postgres:17",
-    `  export ${VARIABLE}=postgres://postgres:caring-contacts-local@127.0.0.1:54329/postgres`,
-    "",
-  ];
-  process.stderr.write(lines.join("\n"));
-  process.exit(1);
+/**
+ * Decide whether the suites may run against `env`, and with which child environment.
+ * Returns `{ error }` when they may not, so the caller can print and exit 1.
+ *
+ * @param {Record<string, string | undefined>} env
+ * @returns {{ error: string, env?: undefined } | { error?: undefined, env: Record<string, string | undefined> }}
+ */
+export function caringContactsDbRunPlan(env) {
+  const url = env[VARIABLE];
+  if (typeof url !== "string" || url.trim() === "") {
+    return {
+      error: [
+        `${VARIABLE} is not set, so the caring-contact database suites cannot run.`,
+        "They are never skipped: row-level security is the control that stops one hospital team",
+        "seeing another team's patients, and it is only proven against a real database.",
+        "",
+        "Start a disposable local Postgres and point the variable at it, for example:",
+        "  docker run --rm -d --name caring-contacts-pg -e POSTGRES_PASSWORD=caring-contacts-local -p 54329:5432 postgres:17",
+        `  export ${VARIABLE}=postgres://postgres:caring-contacts-local@127.0.0.1:54329/postgres`,
+        "",
+      ].join("\n"),
+    };
+  }
+  const hostProblem = caringContactsDatabaseHostProblem(url);
+  if (hostProblem) return { error: `${hostProblem}\n` };
+  return { env: { ...env, [CARING_CONTACTS_DB_TESTS_OPT_IN]: "1" } };
+}
+
+function main() {
+  const plan = caringContactsDbRunPlan(process.env);
+  if (plan.error) {
+    process.stderr.write(plan.error);
+    process.exit(1);
+  }
+
+  const child = spawn(
+    process.execPath,
+    [
+      path.join(projectRoot, "scripts", "run-vitest.mjs"),
+      "run",
+      "--project=caring-contacts-db",
+      ...process.argv.slice(2),
+    ],
+    { cwd: projectRoot, env: plan.env, stdio: "inherit" },
+  );
+  child.on("error", (error) => {
+    process.stderr.write(`${error.message}\n`);
+    process.exit(1);
+  });
+  child.on("close", (status, signal) => process.exit(status === null ? (signal ? 1 : 0) : status));
 }
 
-const child = spawn(
-  process.execPath,
-  [
-    path.join(projectRoot, "scripts", "run-vitest.mjs"),
-    "run",
-    "--project=caring-contacts-db",
-    ...process.argv.slice(2),
-  ],
-  { cwd: projectRoot, env: process.env, stdio: "inherit" },
-);
-child.on("error", (error) => {
-  process.stderr.write(`${error.message}\n`);
-  process.exit(1);
-});
-child.on("close", (status, signal) => process.exit(status === null ? (signal ? 1 : 0) : status));
+const invokedDirectly = process.argv[1] && import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href;
+if (invokedDirectly) main();

data/repo-awareness-snapshot.json

@@ -1,8 +1,8 @@
 {
   "version": "repo-awareness-snapshot-v2",
   "captured_revision": {
-    "sha": "adf5b8eada49b1a304758af930d7dd88fa08d3ab",
-    "committed_at": "2026-09-04T16:58:11+00:00"
+    "sha": "7145490ebed1fc1d2b0f09626f0c975b01adb367",
+    "committed_at": "2026-09-05T18:00:33+08:00"
   },
   "routes": {
     "modes": [
@@ -10609,6 +10609,14 @@
         "outcome": "approved",
         "checks": "git diff --check; script syntax; ledger and issue guards"
       },
+      {
+        "date": "2026-09-04",
+        "ref": "claude/psychsift-modes-architecture-378ktx",
+        "head": "3abade6d40bd373783753105b8579ccdcf245e57",
+        "scope": "prlanded",
+        "outcome": "Merged clean via squash (PR #2614). Content diff between the squash commit and the branch tip (75eabfd, before GitHub deleted the remote branch) is empty — no orphaned late commits, nothing lost from the auto-merge race.",
+        "checks": "PR policy: success; PR mergeability: success; Build: success; Unit coverage: in progress at last check, no failures observed; Production UI (1/2/3): in progress at last check, no failures observed; Safety and config checks: success; Caring Contacts database: success; GitGuardian/Gitleaks/Semgrep: success; merge confirmed via pull_request_read (state closed, merged true, merged_by BigSimmo, merged_at 2026-09-04T12:57:23Z)."
+      },
       {
         "date": "2026-07-28",
         "ref": "PR #1290 / `codex/search-performance-correctness-pr`",

docs/branch-review-index.md

@@ -15,14 +15,14 @@ Retention and rotation: [`branch-review-archival-policy.md`](branch-review-archi
 
 ## Summary
 
-- Records: 606
-- Distinct ref cells: 386
-- Distinct reviewed heads: 589
+- Records: 607
+- Distinct ref cells: 387
+- Distinct reviewed heads: 590
 - Date range: `2026-08-12` to `2026-09-04`
 
 Records per date, newest first:
 
-- `2026-09-04` — 3 records
+- `2026-09-04` — 4 records
 - `2026-09-03` — 12 records
 - `2026-09-02` — 16 records
 - `2026-09-01` — 5 records
@@ -54,6 +54,7 @@ Scope and outcome are truncated; follow the record link for the full six-cell ro
 | --- | --- | --- | --- | --- |
 | 2026-09-04 | claude/smart-test-selection-q4rt7m | prlanded | merged (#2553) — browser-gate planner (npm run plan:browser), arbiter… | [062e844f](branch-review-records/062e844f787018a9ccdf98bca24e4206614b7403a7e3896b73876b228f885005.record.md) |
 | 2026-09-04 | claude/sources-mode-redesign-73uxmc | prlanded | PR #2593 merged as 0f85b91 (true merge, not squash). Verified by conte… | [2eda1b1f](branch-review-records/2eda1b1f3be7656d04189b1da4434bf497c2cb52408d3f88b451597531b2f3bc.record.md) |
+| 2026-09-04 | claude/psychsift-modes-architecture-378ktx | prlanded | Merged clean via squash (PR #2614). Content diff between the squash co… | [971e2ece](branch-review-records/971e2ece5c225bde1c07b353b9a13c70784f23ae6b02d1ea8397882fff0f85cf.record.md) |
 | 2026-09-04 | claude/answer-page-handover-c2qlwy | prlanded | merged (#2541) — 'Report a problem' opens as a Sheet; Codex P2 (sheet… | [b5ca5f1c](branch-review-records/b5ca5f1c00340e7acbc8e643d9cb1250ebfaf72a516175a6a96d06a517ee3f47.record.md) |
 | 2026-09-03 | claude/audit-fix-p1 (PR #2580) | Run PR sweep: CI fix + threads + drift | Before: mergeable_state blocked, 1 unresolved review thread (codex M22… | [05d026fe](branch-review-records/05d026fe646f677e39436ddceb09504fcdedcda3d1b0c75c914fc4bde2fb3b01.record.md) |
 | 2026-09-03 | claude/token-layer-collapse-itskb0 (PR #2577) | Run PR sweep: merge origin/main drift + Codex review threads | before: mergeable_state dirty (real conflict in playwright.config.ts s… | [20984d0f](branch-review-records/20984d0ff09095aeac675096ff3a1fd0610bb26a73bf25fdfa355b3d1fe64535.record.md) |

docs/scripts-index.md

@@ -1,6 +1,6 @@
 # Scripts index
 
-Curated map of `scripts/` (298 files) and the `package.json` script surface (297 entries),
+Curated map of `scripts/` (301 files) and the `package.json` script surface (297 entries),
 grouped by purpose. This is orientation, not an exhaustive per-file listing — the authoritative
 command list is `package.json`, and `npm run docs:check-scripts` verifies every `npm run <x>`
 referenced in docs resolves to a real script. `npm run docs:update` refreshes the exact counts above.

scripts/branch-review-ledger.mjs

@@ -10,7 +10,7 @@
  * no `git rev-parse` lookup could ever match — so the throttle the ledger exists to
  * provide silently never fired.
  *
- *   node scripts/branch-review-ledger.mjs lookup <branch-or-ref> [--head <sha>] [--scope <text>] [--json]
+ *   node scripts/branch-review-ledger.mjs lookup <branch-or-ref> [--head <sha>] [--scope <text>] [--json] [--verbose]
  *   node scripts/branch-review-ledger.mjs append --ref <x> --head <sha> --scope <s> --outcome <o> --checks <c>
  *   node scripts/branch-review-ledger.mjs migrate-legacy [--base <commit>] [--dry-run]
  *   node scripts/branch-review-ledger.mjs dedupe [--dry-run]
@@ -434,7 +434,7 @@ function resolveHead(value, { required = false } = {}) {
   return /^[0-9a-f]{40}$/i.test(cleaned) ? cleaned.toLowerCase() : cleaned;
 }
 
-const BOOLEAN_FLAGS = new Set(["json", "supersede", "dry-run"]);
+const BOOLEAN_FLAGS = new Set(["json", "supersede", "dry-run", "verbose"]);
 
 export function parseFlags(argv) {
   const flags = {};
@@ -471,11 +471,28 @@ function summarize(row) {
   return `  ${row.date}  ${row.head.replace(/`/g, "").slice(0, 12).padEnd(12)}  ${row.scope}\n      ${outcome}`;
 }
 
+/**
+ * The `files:` line of a lookup. Every immutable record is a source, so listing them
+ * put ~580 content-addressed paths on one ~60 KB line ahead of the verdict every time a
+ * reviewer ran the throttle check. Print counts by default; `--verbose` lists the paths.
+ *
+ * @param {string[]} sources
+ * @param {{ verbose?: boolean }} [options]
+ */
+export function lookupFilesLine(sources, { verbose = false } = {}) {
+  if (verbose) return `files: ${sources.join(", ")}`;
+  const records = sources.filter((source) => source.endsWith(RECORD_SUFFIX)).length;
+  const tables = sources.length - records;
+  return `files: ${tables} ledger table(s) + ${records} immutable record(s) (pass --verbose to list them)`;
+}
+
 function runLookup(_liveMarkdown, argv) {
   const { flags, positional } = parseFlags(argv);
   const ref = positional[0] ?? flags.ref;
   if (!ref || ref === true) {
-    console.error("usage: branch-review-ledger.mjs lookup <branch-or-ref> [--head <sha>] [--scope <text>] [--json]");
+    console.error(
+      "usage: branch-review-ledger.mjs lookup <branch-or-ref> [--head <sha>] [--scope <text>] [--json] [--verbose]",
+    );
     process.exitCode = 2;
     return;
   }
@@ -493,7 +510,7 @@ function runLookup(_liveMarkdown, argv) {
   console.log(`ref:   ${ref}`);
   console.log(`head:  ${head}${/^[0-9a-f]{40}$/.test(head) ? "" : "  (not resolvable to a SHA here)"}`);
   if (scope) console.log(`scope: exact ${JSON.stringify(scope)}`);
-  console.log(`files: ${sources.join(", ")}`);
+  console.log(lookupFilesLine(sources, { verbose: flags.verbose === true }));
   console.log("");
 
   if (atHead.length > 0) {
@@ -955,7 +972,7 @@ function main() {
   if (command === "dedupe") return runDedupe(markdown, rest);
   if (command === "rotate") return runRotate(markdown, rest);
   console.error("usage: branch-review-ledger.mjs <lookup|append|migrate-legacy|dedupe|rotate|--self-test> [...]");
-  console.error("  lookup <branch-or-ref> [--head <sha>] [--scope <text>] [--json]");
+  console.error("  lookup <branch-or-ref> [--head <sha>] [--scope <text>] [--json] [--verbose]");
   console.error(
     "  append --ref <x> --head <sha> --scope <s> --outcome <o> --checks <c> [--date <YYYY-MM-DD>] [--supersede]",
   );

scripts/cli-utils.ts

@@ -1,20 +1,8 @@
-import { createInterface } from "node:readline";
-
 /**
  * Prompts the user with a yes/no question and returns their answer.
  * Returns `false` if stdin is not a TTY (e.g. when piped).
+ *
+ * The implementation lives in scripts/lib/confirm.mjs so every script — TypeScript or
+ * plain module — shares one prompt helper; this re-export keeps existing imports working.
  */
-export function confirm(question: string): Promise<boolean> {
-  if (!process.stdin.isTTY) {
-    console.log("  Non-interactive input detected; defaulting to No.");
-    return Promise.resolve(false);
-  }
-
-  return new Promise((resolve) => {
-    const rl = createInterface({ input: process.stdin, output: process.stdout });
-    rl.question(`${question} (y/N) `, (answer: string) => {
-      rl.close();
-      resolve(answer.trim().toLowerCase() === "y");
-    });
-  });
-}
+export { confirm, createPrompt } from "./lib/confirm.mjs";