The `unresolvedHint` fail-closed added for #772 finding 7 had no
`candidates.length > 0` guard, so it fired on pure EQL v2 tables too.

`encrypt backfill` records `encryptedColumn` in migrations.json
unconditionally, v2 included. On a pure-v2 table `listEncryptedColumns`
returns [] (the classifier recognises `eql_v3_*` only), so the hint failed
to resolve, `columnExists` found the real `eql_v2_encrypted` column, and
`cutover` / `drop` exited 1 — telling users to downgrade for a lifecycle
this same build still fully implements in cutover.ts / drop.ts.

Gate the fail-closed on a non-empty candidate list. Finding 7's protection
is unchanged: the mixed table it targets always has candidates. Order
`explainUnresolved`'s empty-candidates fall-through ahead of the hint
branch so both agree for direct callers.

Also drop the "this release no longer manages that lifecycle" claim from
the cutover/drop `via: 'sole'` messages — the build does still implement
it; the command simply resolves EQL v3 counterparts only.

Tests cover the previously untested shape: candidates [] + a recorded hint.

Review follow-ups:
- Extend the placeholder-table guard to `encrypt backfill` via
  loadEncryptionContext; correct the changeset/skill wording to name the
  commands that actually refuse (cutover/drop never read the client file).
- Alias `@cipherstash/migrate` to source in the CLI unit vitest config, so
  `pnpm --filter stash test` no longer needs a prior workspace build
  (verified: 888 tests pass with packages/migrate/dist removed).
- Revert the unrelated em-dash re-encoding in packages/cli/package.json.

Follow-up to 1d14412, from an adversarial cross-check of that commit.

Blocking, and self-inflicted: `git checkout origin/main -- packages/cli/package.json`
(the em-dash revert) also imported main's Dependabot bump of posthog-node to
^5.41.0, which this branch's lockfile predates. Every CI job starts with
`pnpm install --frozen-lockfile`, so the PR died at step 1 before a test ran.
Back to ^5.40.0, matching the lockfile and packages/wizard.

resolve-eql's private `columnExists` used a bare `to_regclass($1)`. That form
parses and case-folds unquoted identifiers, so on a Prisma-style "User" table
the probe reported the column missing, the recorded pairing was treated as
stale, and the #772 fail-closed silently did not fire — falling through to the
sole/convention rules and resolving the guess it exists to prevent. migrate
already documents this exact anti-pattern (REGCLASS_SQL) and its test asserts
`not.toMatch(/to_regclass\(\$1\)/)`. Moved to a shared, case-exact
`columnExists` export and deleted the CLI copy; the test double is now
case-exact too, so it cannot hide a regression.

The placeholder guard read the harvested export map while the `db push` /
`db validate` guard it mirrors reads `getEncryptConfig().tables`. Those
disagree in both directions on one file: `schemas: [placeholderTable]` minus
the `export` keyword fell through to "table not found … Available: (none)" —
the error the guard replaces — and a stale placeholder export beside real
tables wrongly fired it. Now reads the same source.

cutover's `via:'sole'` refusal was nested inside `version === 3`; drop's is
top-level. Equivalent today, but cutover's v2 ladder does an irreversible
rename plus config promotion, so a restored v2 classification or a v4 family
would let cutover rename on a guess drop refuses. Hoisted to match.

Text that was false:
- the scaffold `stash init` writes into every customer project (and both
  fixtures) claimed `stash encrypt` commands refuse to run; only backfill does
- skills/stash-cli listed the client as loaded by `schema build` and `encrypt *`,
  and omitted `db push`
- skills/stash-cli and skills/stash-encryption still said cutover on a backfilled
  v3 column exits 0. Since `.cipherstash/` is gitignored, a clone or CI runner
  hits the new `sole` refusal on a pure-v3 table with an unconventional column
  name — the changeset's "pure-v3 unaffected" was wrong too
- both `sole` messages said "the table's only EQL column"; pickEncryptedColumn
  excludes the plaintext column first, so it fires with two
- the remedy said to drive the v2 lifecycle "directly"; there is no CLI route,
  so it now says to run the eql_v2 SQL yourself
- vitest.config.ts and packages/cli/AGENTS.md claimed the unit suite is
  self-contained. It is not: @cipherstash/stack is still reached via
  migrate/src/backfill.ts. The alias removed one of two couplings

typecheck:scaffold ran `tsc` directly, bypassing turbo, so it needed a prior
build and passed only by accident of step ordering behind steps that read as
independently droppable. Now a turbo task with dependsOn ^build.

Added scripts/__tests__/cli-vitest-alias.test.mjs — the CLI's alias map sits
outside the vitest.shared.ts guard and must, since stackSourceAlias's '@/'
would clobber the CLI's own. Runs in test:scripts, ahead of the build-dependent
suite.

Verified: frozen-lockfile install clean; 891 CLI unit, 41 migrate, 93 scripts,
76 pty e2e; code:check 0 errors; scaffold gate green through turbo with
packages/stack/dist absent.

…exposed

The reviewer's two findings were both already fixed at bbade2c — this adds
the guards that would have caught them, plus two accuracy fixes.

`typecheck:scaffold` declares `dependsOn: ["^build"]`, so turbo has to be the
thing invoking it. #787 first added it as a bare `pnpm --filter stash run
typecheck:scaffold` and CI went green anyway: an earlier step in the same job
happened to build the workspace via its own `^build`. Those earlier steps read
as independent guards for other packages, so they look freely removable —
delete one and the scaffold step fails `TS2307`, which reads as "the scaffold
is broken" rather than "you skipped the build". Nothing caught that.

scripts/__tests__/workflow-turbo-build-deps.test.mjs derives the protected set
from turbo.json (every task declaring `^build`) rather than hardcoding names,
and asserts tests.yml routes them through turbo. Mutation-tested against three
regressions: reverting the step to the bare form, deleting the step outright,
and adding a new bare build-dependent step — each fails with a message naming
the step and the fix. Two pre-existing bare `typecheck` invocations
(prisma-next, wizard) carry the same latent trap; they are recorded in
KNOWN_BARE rather than silently skipped, and a fourth test fails if an entry
goes stale so the list gets worked down instead of accumulating.

Two accuracy fixes:

- vitest.config.ts claimed the suite's residual `@cipherstash/stack` coupling
  runs through `migrate/src/backfill.ts`. That is only one of two routes:
  `init/lib/__tests__/introspect.test.ts:1` imports `@cipherstash/stack/eql/v3`
  directly, never touching migrate. As written, someone could decouple
  backfill.ts and expect the suite to go standalone. It would not.

- cli-vitest-alias.test.mjs called `.endsWith()` on every alias value, so
  Vite's array form (`[{find, replacement}]`) would throw an opaque TypeError
  from a helper — reading as "the guard is broken" rather than "the config
  changed shape". It now fails cleanly, naming the offender, and says to update
  the guard rather than delete it.

No changeset: repo tooling and a comment, no published surface touched.

The `unresolvedHint` fail-closed added for #772 finding 7 had no
`candidates.length > 0` guard, so it fired on pure EQL v2 tables too.

`encrypt backfill` records `encryptedColumn` in migrations.json
unconditionally, v2 included. On a pure-v2 table `listEncryptedColumns`
returns [] (the classifier recognises `eql_v3_*` only), so the hint failed
to resolve, `columnExists` found the real `eql_v2_encrypted` column, and
`cutover` / `drop` exited 1 — telling users to downgrade for a lifecycle
this same build still fully implements in cutover.ts / drop.ts.

Gate the fail-closed on a non-empty candidate list. Finding 7's protection
is unchanged: the mixed table it targets always has candidates. Order
`explainUnresolved`'s empty-candidates fall-through ahead of the hint
branch so both agree for direct callers.

Also drop the "this release no longer manages that lifecycle" claim from
the cutover/drop `via: 'sole'` messages — the build does still implement
it; the command simply resolves EQL v3 counterparts only.

Tests cover the previously untested shape: candidates [] + a recorded hint.

Review follow-ups:
- Extend the placeholder-table guard to `encrypt backfill` via
  loadEncryptionContext; correct the changeset/skill wording to name the
  commands that actually refuse (cutover/drop never read the client file).
- Alias `@cipherstash/migrate` to source in the CLI unit vitest config, so
  `pnpm --filter stash test` no longer needs a prior workspace build
  (verified: 888 tests pass with packages/migrate/dist removed).
- Revert the unrelated em-dash re-encoding in packages/cli/package.json.

Follow-up to 1d14412, from an adversarial cross-check of that commit.

Blocking, and self-inflicted: `git checkout origin/main -- packages/cli/package.json`
(the em-dash revert) also imported main's Dependabot bump of posthog-node to
^5.41.0, which this branch's lockfile predates. Every CI job starts with
`pnpm install --frozen-lockfile`, so the PR died at step 1 before a test ran.
Back to ^5.40.0, matching the lockfile and packages/wizard.

resolve-eql's private `columnExists` used a bare `to_regclass($1)`. That form
parses and case-folds unquoted identifiers, so on a Prisma-style "User" table
the probe reported the column missing, the recorded pairing was treated as
stale, and the #772 fail-closed silently did not fire — falling through to the
sole/convention rules and resolving the guess it exists to prevent. migrate
already documents this exact anti-pattern (REGCLASS_SQL) and its test asserts
`not.toMatch(/to_regclass\(\$1\)/)`. Moved to a shared, case-exact
`columnExists` export and deleted the CLI copy; the test double is now
case-exact too, so it cannot hide a regression.

The placeholder guard read the harvested export map while the `db push` /
`db validate` guard it mirrors reads `getEncryptConfig().tables`. Those
disagree in both directions on one file: `schemas: [placeholderTable]` minus
the `export` keyword fell through to "table not found … Available: (none)" —
the error the guard replaces — and a stale placeholder export beside real
tables wrongly fired it. Now reads the same source.

cutover's `via:'sole'` refusal was nested inside `version === 3`; drop's is
top-level. Equivalent today, but cutover's v2 ladder does an irreversible
rename plus config promotion, so a restored v2 classification or a v4 family
would let cutover rename on a guess drop refuses. Hoisted to match.

Text that was false:
- the scaffold `stash init` writes into every customer project (and both
  fixtures) claimed `stash encrypt` commands refuse to run; only backfill does
- skills/stash-cli listed the client as loaded by `schema build` and `encrypt *`,
  and omitted `db push`
- skills/stash-cli and skills/stash-encryption still said cutover on a backfilled
  v3 column exits 0. Since `.cipherstash/` is gitignored, a clone or CI runner
  hits the new `sole` refusal on a pure-v3 table with an unconventional column
  name — the changeset's "pure-v3 unaffected" was wrong too
- both `sole` messages said "the table's only EQL column"; pickEncryptedColumn
  excludes the plaintext column first, so it fires with two
- the remedy said to drive the v2 lifecycle "directly"; there is no CLI route,
  so it now says to run the eql_v2 SQL yourself
- vitest.config.ts and packages/cli/AGENTS.md claimed the unit suite is
  self-contained. It is not: @cipherstash/stack is still reached via
  migrate/src/backfill.ts. The alias removed one of two couplings

typecheck:scaffold ran `tsc` directly, bypassing turbo, so it needed a prior
build and passed only by accident of step ordering behind steps that read as
independently droppable. Now a turbo task with dependsOn ^build.

Added scripts/__tests__/cli-vitest-alias.test.mjs — the CLI's alias map sits
outside the vitest.shared.ts guard and must, since stackSourceAlias's '@/'
would clobber the CLI's own. Runs in test:scripts, ahead of the build-dependent
suite.

Verified: frozen-lockfile install clean; 891 CLI unit, 41 migrate, 93 scripts,
76 pty e2e; code:check 0 errors; scaffold gate green through turbo with
packages/stack/dist absent.

…exposed

The reviewer's two findings were both already fixed at bbade2c — this adds
the guards that would have caught them, plus two accuracy fixes.

`typecheck:scaffold` declares `dependsOn: ["^build"]`, so turbo has to be the
thing invoking it. #787 first added it as a bare `pnpm --filter stash run
typecheck:scaffold` and CI went green anyway: an earlier step in the same job
happened to build the workspace via its own `^build`. Those earlier steps read
as independent guards for other packages, so they look freely removable —
delete one and the scaffold step fails `TS2307`, which reads as "the scaffold
is broken" rather than "you skipped the build". Nothing caught that.

scripts/__tests__/workflow-turbo-build-deps.test.mjs derives the protected set
from turbo.json (every task declaring `^build`) rather than hardcoding names,
and asserts tests.yml routes them through turbo. Mutation-tested against three
regressions: reverting the step to the bare form, deleting the step outright,
and adding a new bare build-dependent step — each fails with a message naming
the step and the fix. Two pre-existing bare `typecheck` invocations
(prisma-next, wizard) carry the same latent trap; they are recorded in
KNOWN_BARE rather than silently skipped, and a fourth test fails if an entry
goes stale so the list gets worked down instead of accumulating.

turbo.json is JSONC, so reading it needs the string-aware comment stripper
#782 wrote for `turbo-skills-inputs.test.mjs` — a naive regex eats the `//` in
`"$schema": "https://turbo.build/schema.json"`. Rather than hand-copy 30 lines
of parser into an adjacent file, that function moves to
`scripts/__tests__/lib/read-jsonc.mjs` and both guards import it.

Two accuracy fixes:

- vitest.config.ts claimed the suite's residual `@cipherstash/stack` coupling
  runs through `migrate/src/backfill.ts`. That is only one of two routes:
  `init/lib/__tests__/introspect.test.ts:1` imports `@cipherstash/stack/eql/v3`
  directly, never touching migrate. As written, someone could decouple
  backfill.ts and expect the suite to go standalone. It would not.

- cli-vitest-alias.test.mjs called `.endsWith()` on every alias value, so
  Vite's array form (`[{find, replacement}]`) would throw an opaque TypeError
  from a helper — reading as "the guard is broken" rather than "the config
  changed shape". It now fails cleanly, naming the offender, and says to update
  the guard rather than delete it.

No changeset: repo tooling and a comment, no published surface touched.

The `unresolvedHint` fail-closed added for #772 finding 7 had no
`candidates.length > 0` guard, so it fired on pure EQL v2 tables too.

`encrypt backfill` records `encryptedColumn` in migrations.json
unconditionally, v2 included. On a pure-v2 table `listEncryptedColumns`
returns [] (the classifier recognises `eql_v3_*` only), so the hint failed
to resolve, `columnExists` found the real `eql_v2_encrypted` column, and
`cutover` / `drop` exited 1 — telling users to downgrade for a lifecycle
this same build still fully implements in cutover.ts / drop.ts.

Gate the fail-closed on a non-empty candidate list. Finding 7's protection
is unchanged: the mixed table it targets always has candidates. Order
`explainUnresolved`'s empty-candidates fall-through ahead of the hint
branch so both agree for direct callers.

Also drop the "this release no longer manages that lifecycle" claim from
the cutover/drop `via: 'sole'` messages — the build does still implement
it; the command simply resolves EQL v3 counterparts only.

Tests cover the previously untested shape: candidates [] + a recorded hint.

Review follow-ups:
- Extend the placeholder-table guard to `encrypt backfill` via
  loadEncryptionContext; correct the changeset/skill wording to name the
  commands that actually refuse (cutover/drop never read the client file).
- Alias `@cipherstash/migrate` to source in the CLI unit vitest config, so
  `pnpm --filter stash test` no longer needs a prior workspace build
  (verified: 888 tests pass with packages/migrate/dist removed).
- Revert the unrelated em-dash re-encoding in packages/cli/package.json.

Follow-up to 1d14412, from an adversarial cross-check of that commit.

resolve-eql's private `columnExists` used a bare `to_regclass($1)`. That form
parses and case-folds unquoted identifiers, so on a Prisma-style "User" table
the probe reported the column missing, the recorded pairing was treated as
stale, and the #772 fail-closed silently did not fire — falling through to the
sole/convention rules and resolving the guess it exists to prevent. migrate
already documents this exact anti-pattern (REGCLASS_SQL) and its test asserts
`not.toMatch(/to_regclass\(\$1\)/)`. Moved to a shared, case-exact
`columnExists` export and deleted the CLI copy; the test double is now
case-exact too, so it cannot hide a regression.

The placeholder guard read the harvested export map while the `db push` /
`db validate` guard it mirrors reads `getEncryptConfig().tables`. Those
disagree in both directions on one file: `schemas: [placeholderTable]` minus
the `export` keyword fell through to "table not found … Available: (none)" —
the error the guard replaces — and a stale placeholder export beside real
tables wrongly fired it. Now reads the same source.

cutover's `via:'sole'` refusal was nested inside `version === 3`; drop's is
top-level. Equivalent today, but cutover's v2 ladder does an irreversible
rename plus config promotion, so a restored v2 classification or a v4 family
would let cutover rename on a guess drop refuses. Hoisted to match.

Text that was false:
- the scaffold `stash init` writes into every customer project (and both
  fixtures) claimed `stash encrypt` commands refuse to run; only backfill does
- skills/stash-cli listed the client as loaded by `schema build` and `encrypt *`,
  and omitted `db push`
- skills/stash-cli and skills/stash-encryption still said cutover on a backfilled
  v3 column exits 0. Since `.cipherstash/` is gitignored, a clone or CI runner
  hits the new `sole` refusal on a pure-v3 table with an unconventional column
  name — the changeset's "pure-v3 unaffected" was wrong too
- both `sole` messages said "the table's only EQL column"; pickEncryptedColumn
  excludes the plaintext column first, so it fires with two
- the remedy said to drive the v2 lifecycle "directly"; there is no CLI route,
  so it now says to run the eql_v2 SQL yourself
- vitest.config.ts and packages/cli/AGENTS.md claimed the unit suite is
  self-contained. It is not: @cipherstash/stack is still reached via
  migrate/src/backfill.ts. The alias removed one of two couplings

typecheck:scaffold ran `tsc` directly, bypassing turbo, so it needed a prior
build and passed only by accident of step ordering behind steps that read as
independently droppable. Now a turbo task with dependsOn ^build.

Added scripts/__tests__/cli-vitest-alias.test.mjs — the CLI's alias map sits
outside the vitest.shared.ts guard and must, since stackSourceAlias's '@/'
would clobber the CLI's own. Runs in test:scripts, ahead of the build-dependent
suite.

Verified: frozen-lockfile install clean; 891 CLI unit, 41 migrate, 93 scripts,
76 pty e2e; code:check 0 errors; scaffold gate green through turbo with
packages/stack/dist absent.

…exposed

The reviewer's two findings were both already fixed at bbade2c — this adds
the guards that would have caught them, plus two accuracy fixes.

`typecheck:scaffold` declares `dependsOn: ["^build"]`, so turbo has to be the
thing invoking it. #787 first added it as a bare `pnpm --filter stash run
typecheck:scaffold` and CI went green anyway: an earlier step in the same job
happened to build the workspace via its own `^build`. Those earlier steps read
as independent guards for other packages, so they look freely removable —
delete one and the scaffold step fails `TS2307`, which reads as "the scaffold
is broken" rather than "you skipped the build". Nothing caught that.

scripts/__tests__/workflow-turbo-build-deps.test.mjs derives the protected set
from turbo.json (every task declaring `^build`) rather than hardcoding names,
and asserts tests.yml routes them through turbo. Mutation-tested against three
regressions: reverting the step to the bare form, deleting the step outright,
and adding a new bare build-dependent step — each fails with a message naming
the step and the fix. Two pre-existing bare `typecheck` invocations
(prisma-next, wizard) carry the same latent trap; they are recorded in
KNOWN_BARE rather than silently skipped, and a fourth test fails if an entry
goes stale so the list gets worked down instead of accumulating.

turbo.json is JSONC, so reading it needs the string-aware comment stripper
#782 wrote for `turbo-skills-inputs.test.mjs` — a naive regex eats the `//` in
`"$schema": "https://turbo.build/schema.json"`. Rather than hand-copy 30 lines
of parser into an adjacent file, that function moves to
`scripts/__tests__/lib/read-jsonc.mjs` and both guards import it.

Two accuracy fixes:

- vitest.config.ts claimed the suite's residual `@cipherstash/stack` coupling
  runs through `migrate/src/backfill.ts`. That is only one of two routes:
  `init/lib/__tests__/introspect.test.ts:1` imports `@cipherstash/stack/eql/v3`
  directly, never touching migrate. As written, someone could decouple
  backfill.ts and expect the suite to go standalone. It would not.

- cli-vitest-alias.test.mjs called `.endsWith()` on every alias value, so
  Vite's array form (`[{find, replacement}]`) would throw an opaque TypeError
  from a helper — reading as "the guard is broken" rather than "the config
  changed shape". It now fails cleanly, naming the offender, and says to update
  the guard rather than delete it.

No changeset: repo tooling and a comment, no published surface touched.

Follow-up to the #787 review. Five gaps, none raised by the reviewer, all
found by auditing what the PR's own tests actually pin.

A guard clause that no test held. `context-placeholder.test.ts` named a case
it did not construct: its fixture returned `getEncryptConfig: () => ({})`, so
`configuredTables` was empty and the guard short-circuited on the arity check
before the sentinel-name comparison ever ran. Deleting
`configuredTables.length === 1` left all 891 tests green — measured, not
argued. The fixture now declares the sentinel FIRST alongside a real table,
because the guard indexes `[0]`, and both tests spy `process.exit` so a
regression fails as an assertion instead of killing the worker.

One guard, not two. The same refusal was hand-copied into `loadEncryptConfig`
and `loadEncryptionContext`, sharing only the constant — and it had already
drifted: on a client whose `getEncryptConfig()` returns nothing, `db push`
named the cause while `encrypt backfill` fell through to `Table "..." was not
found`, the symptom-not-cause message the guard exists to replace. Both now
call `requireUsableEncryptConfig`, pinned by a parity test asserting the two
seams emit byte-identical text.

The resolver/command seam, tested. `encrypt-v3.test.ts` stubs
`resolveColumnLifecycle` and hand-writes its return value; `resolve-eql.test.ts`
proves the pure-v2 shape produces that value. Nothing ran the real producer
into the real consumer. The new composition test mocks no resolution at all —
only pg, fs, prompts and the effectful migrate helpers — so the v2 verdict is
derived from a real manifest hint and a real catalog read. Mutation-checked:
the two #787 defences are independent, so removing either alone is masked by
the other; removing both fails this test and nothing else. Its sibling types
are now imported rather than re-declared, so the shape cannot drift silently.

The workflow guard, applied to all workflows. It scanned only `tests.yml`
while enforcing a rule its own docblock generalises. Widened to all 13, which
surfaced six real bare invocations of `^build`-dependent tasks — five
`test:integration`, plus a `test:e2e` that `rootScriptDelegatesToTurbo` was
wrongly exempting (a `--filter` invocation runs the PACKAGE's script, so the
root script's delegation says nothing about it). All six routed through turbo
with `--env-mode=loose`: turbo defaults to strict and would otherwise withhold
the step env these suites need, which `passThroughEnv` could only fix by
enumerating ten variables across workflows this change cannot execute.

Also corrects `AGENTS.md`'s path to `introspect.test.ts` and states the
`stackSourceAlias` collision symmetrically — spreading it either way breaks
one package's `'@/'`. Its "fails 10 files" figure was re-measured by deleting
`packages/stack/dist`: exactly 10.

`stash` unit suite 896/896, scripts 112/112, typecheck:scaffold clean, Biome
0 errors.

The `unresolvedHint` fail-closed added for #772 finding 7 had no
`candidates.length > 0` guard, so it fired on pure EQL v2 tables too.

`encrypt backfill` records `encryptedColumn` in migrations.json
unconditionally, v2 included. On a pure-v2 table `listEncryptedColumns`
returns [] (the classifier recognises `eql_v3_*` only), so the hint failed
to resolve, `columnExists` found the real `eql_v2_encrypted` column, and
`cutover` / `drop` exited 1 — telling users to downgrade for a lifecycle
this same build still fully implements in cutover.ts / drop.ts.

Gate the fail-closed on a non-empty candidate list. Finding 7's protection
is unchanged: the mixed table it targets always has candidates. Order
`explainUnresolved`'s empty-candidates fall-through ahead of the hint
branch so both agree for direct callers.

Also drop the "this release no longer manages that lifecycle" claim from
the cutover/drop `via: 'sole'` messages — the build does still implement
it; the command simply resolves EQL v3 counterparts only.

Tests cover the previously untested shape: candidates [] + a recorded hint.

Review follow-ups:
- Extend the placeholder-table guard to `encrypt backfill` via
  loadEncryptionContext; correct the changeset/skill wording to name the
  commands that actually refuse (cutover/drop never read the client file).
- Alias `@cipherstash/migrate` to source in the CLI unit vitest config, so
  `pnpm --filter stash test` no longer needs a prior workspace build
  (verified: 888 tests pass with packages/migrate/dist removed).
- Revert the unrelated em-dash re-encoding in packages/cli/package.json.

Follow-up to 1d14412, from an adversarial cross-check of that commit.

resolve-eql's private `columnExists` used a bare `to_regclass($1)`. That form
parses and case-folds unquoted identifiers, so on a Prisma-style "User" table
the probe reported the column missing, the recorded pairing was treated as
stale, and the #772 fail-closed silently did not fire — falling through to the
sole/convention rules and resolving the guess it exists to prevent. migrate
already documents this exact anti-pattern (REGCLASS_SQL) and its test asserts
`not.toMatch(/to_regclass\(\$1\)/)`. Moved to a shared, case-exact
`columnExists` export and deleted the CLI copy; the test double is now
case-exact too, so it cannot hide a regression.

The placeholder guard read the harvested export map while the `db push` /
`db validate` guard it mirrors reads `getEncryptConfig().tables`. Those
disagree in both directions on one file: `schemas: [placeholderTable]` minus
the `export` keyword fell through to "table not found … Available: (none)" —
the error the guard replaces — and a stale placeholder export beside real
tables wrongly fired it. Now reads the same source.

cutover's `via:'sole'` refusal was nested inside `version === 3`; drop's is
top-level. Equivalent today, but cutover's v2 ladder does an irreversible
rename plus config promotion, so a restored v2 classification or a v4 family
would let cutover rename on a guess drop refuses. Hoisted to match.

Text that was false:
- the scaffold `stash init` writes into every customer project (and both
  fixtures) claimed `stash encrypt` commands refuse to run; only backfill does
- skills/stash-cli listed the client as loaded by `schema build` and `encrypt *`,
  and omitted `db push`
- skills/stash-cli and skills/stash-encryption still said cutover on a backfilled
  v3 column exits 0. Since `.cipherstash/` is gitignored, a clone or CI runner
  hits the new `sole` refusal on a pure-v3 table with an unconventional column
  name — the changeset's "pure-v3 unaffected" was wrong too
- both `sole` messages said "the table's only EQL column"; pickEncryptedColumn
  excludes the plaintext column first, so it fires with two
- the remedy said to drive the v2 lifecycle "directly"; there is no CLI route,
  so it now says to run the eql_v2 SQL yourself
- vitest.config.ts and packages/cli/AGENTS.md claimed the unit suite is
  self-contained. It is not: @cipherstash/stack is still reached via
  migrate/src/backfill.ts. The alias removed one of two couplings

typecheck:scaffold ran `tsc` directly, bypassing turbo, so it needed a prior
build and passed only by accident of step ordering behind steps that read as
independently droppable. Now a turbo task with dependsOn ^build.

Added scripts/__tests__/cli-vitest-alias.test.mjs — the CLI's alias map sits
outside the vitest.shared.ts guard and must, since stackSourceAlias's '@/'
would clobber the CLI's own. Runs in test:scripts, ahead of the build-dependent
suite.

Verified: frozen-lockfile install clean; 891 CLI unit, 41 migrate, 93 scripts,
76 pty e2e; code:check 0 errors; scaffold gate green through turbo with
packages/stack/dist absent.

…exposed

The reviewer's two findings were both already fixed at bbade2c — this adds
the guards that would have caught them, plus two accuracy fixes.

`typecheck:scaffold` declares `dependsOn: ["^build"]`, so turbo has to be the
thing invoking it. #787 first added it as a bare `pnpm --filter stash run
typecheck:scaffold` and CI went green anyway: an earlier step in the same job
happened to build the workspace via its own `^build`. Those earlier steps read
as independent guards for other packages, so they look freely removable —
delete one and the scaffold step fails `TS2307`, which reads as "the scaffold
is broken" rather than "you skipped the build". Nothing caught that.

scripts/__tests__/workflow-turbo-build-deps.test.mjs derives the protected set
from turbo.json (every task declaring `^build`) rather than hardcoding names,
and asserts tests.yml routes them through turbo. Mutation-tested against three
regressions: reverting the step to the bare form, deleting the step outright,
and adding a new bare build-dependent step — each fails with a message naming
the step and the fix. Two pre-existing bare `typecheck` invocations
(prisma-next, wizard) carry the same latent trap; they are recorded in
KNOWN_BARE rather than silently skipped, and a fourth test fails if an entry
goes stale so the list gets worked down instead of accumulating.

turbo.json is JSONC, so reading it needs the string-aware comment stripper
#782 wrote for `turbo-skills-inputs.test.mjs` — a naive regex eats the `//` in
`"$schema": "https://turbo.build/schema.json"`. Rather than hand-copy 30 lines
of parser into an adjacent file, that function moves to
`scripts/__tests__/lib/read-jsonc.mjs` and both guards import it.

Two accuracy fixes:

- vitest.config.ts claimed the suite's residual `@cipherstash/stack` coupling
  runs through `migrate/src/backfill.ts`. That is only one of two routes:
  `init/lib/__tests__/introspect.test.ts:1` imports `@cipherstash/stack/eql/v3`
  directly, never touching migrate. As written, someone could decouple
  backfill.ts and expect the suite to go standalone. It would not.

- cli-vitest-alias.test.mjs called `.endsWith()` on every alias value, so
  Vite's array form (`[{find, replacement}]`) would throw an opaque TypeError
  from a helper — reading as "the guard is broken" rather than "the config
  changed shape". It now fails cleanly, naming the offender, and says to update
  the guard rather than delete it.

No changeset: repo tooling and a comment, no published surface touched.

Follow-up to the #787 review. Five gaps, none raised by the reviewer, all
found by auditing what the PR's own tests actually pin.

A guard clause that no test held. `context-placeholder.test.ts` named a case
it did not construct: its fixture returned `getEncryptConfig: () => ({})`, so
`configuredTables` was empty and the guard short-circuited on the arity check
before the sentinel-name comparison ever ran. Deleting
`configuredTables.length === 1` left all 891 tests green — measured, not
argued. The fixture now declares the sentinel FIRST alongside a real table,
because the guard indexes `[0]`, and both tests spy `process.exit` so a
regression fails as an assertion instead of killing the worker.

One guard, not two. The same refusal was hand-copied into `loadEncryptConfig`
and `loadEncryptionContext`, sharing only the constant — and it had already
drifted: on a client whose `getEncryptConfig()` returns nothing, `db push`
named the cause while `encrypt backfill` fell through to `Table "..." was not
found`, the symptom-not-cause message the guard exists to replace. Both now
call `requireUsableEncryptConfig`, pinned by a parity test asserting the two
seams emit byte-identical text.

The resolver/command seam, tested. `encrypt-v3.test.ts` stubs
`resolveColumnLifecycle` and hand-writes its return value; `resolve-eql.test.ts`
proves the pure-v2 shape produces that value. Nothing ran the real producer
into the real consumer. The new composition test mocks no resolution at all —
only pg, fs, prompts and the effectful migrate helpers — so the v2 verdict is
derived from a real manifest hint and a real catalog read. Mutation-checked:
the two #787 defences are independent, so removing either alone is masked by
the other; removing both fails this test and nothing else. Its sibling types
are now imported rather than re-declared, so the shape cannot drift silently.

The workflow guard, applied to all workflows. It scanned only `tests.yml`
while enforcing a rule its own docblock generalises. Widened to all 13, which
surfaced six real bare invocations of `^build`-dependent tasks — five
`test:integration`, plus a `test:e2e` that `rootScriptDelegatesToTurbo` was
wrongly exempting (a `--filter` invocation runs the PACKAGE's script, so the
root script's delegation says nothing about it). All six routed through turbo
with `--env-mode=loose`: turbo defaults to strict and would otherwise withhold
the step env these suites need, which `passThroughEnv` could only fix by
enumerating ten variables across workflows this change cannot execute.

Also corrects `AGENTS.md`'s path to `introspect.test.ts` and states the
`stackSourceAlias` collision symmetrically — spreading it either way breaks
one package's `'@/'`. Its "fails 10 files" figure was re-measured by deleting
`packages/stack/dist`: exactly 10.

`stash` unit suite 896/896, scripts 112/112, typecheck:scaffold clean, Biome
0 errors.