test(money): verify check payer DDL safety

[Clarion1631]

Summary

• adds deterministic regression coverage for the check-payer DDL verifier
• proves schema-qualified constraint lookup, read-only foundation preflight, exact host matching, exact CHECK definition verification, and exact TIMESTAMPTZ(6) verification
• includes the new test in test:bank-ledger

Important scope note

The implementation under test was already incorporated into main by commit 854c3eb3 (fix(deploy): anchor Users* ignore to repo root) before this clean task branch was prepared. That unrelated deploy commit bundled scripts/apply-check-payer-extraction.mjs. This PR adds the missing verifier evidence only. The task's final independent review covers both that implementation delta and this PR's regression tests.

No database URL was used. No DDL was run.

Verification

• npx tsx --test tests/apply-check-payer-extraction.test.ts — 6 passed
• node scripts/apply-check-payer-extraction.mjs --dry-run — SQL printed; nothing executed
• npm run test:bank-ledger — 527 passed, 1 skipped, 0 failed
• npx prisma generate && npm run typecheck — passed
• npx eslint scripts/apply-check-payer-extraction.mjs tests/apply-check-payer-extraction.test.ts — 0 errors; script is ignored by repository lint config
• git diff --check origin/main...HEAD — passed

Risk

Money-path migration tooling. Review only; do not merge until the task's final independent review is attached.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
probuild	Ready	Preview	Aug 29, 2026 1:17am

[Clarion1631]

Final independent money-path review

REVIEW: VERDICT: SHIP

• Codex: SHIP
• Claude Opus: SHIP
• Review artifact: sha256:1b9a4c98e7b9 (kind=money)
• Findings: no blocker, major, or minor findings
• Confirmed safeguards: schema-qualified constraint lookup, read-only preflight before DDL, exact DB/host checks, exact CHECK invariant verification, and exact TIMESTAMPTZ(6) verification
• Confirmed tests are mock-only and assert zero DDL before a failed preflight

No database URL was used. No DDL was run. This comment records review only; the PR was not merged.

[Clarion1631]

CI evidence

flowchart LR
  PR["PR #413: package + verifier tests"] --> BUILD["Build + bundle ✅"]
  PR --> VERCEL["Vercel preview ✅"]
  MAIN["Current main baseline"] --> MIG["Migration-shape check ❌"]
  PR --> E2E["Playwright: 506 pass / 1 fail / 1 flaky ❌"]

Loading

• The migration-shape check has the same missing BankImage migration on current main (main run 33220547424).
• The Playwright failure is outside this PR's two-file test/package diff: the time-clock test found the Clock In button disabled. The report-page case passed on retry and was marked flaky.
• No merge was attempted.