fix(#417): codex round 1 — unconditional build, broad path guard, column-level coverage

- generate.sh builds the Release solution unconditionally: the previous
  existence check reused a stale assembly after a migration was added
  and documented the PREVIOUS schema as current. Incremental build is
  near-free when everything is fresh.
- The environment-leak guard's path rule is now any /-leading token
  (plus case-insensitive drive letters), not a prefix list — the
  generator's own /work container mount is identical on every machine,
  so only this guard can catch that class of leak. Verified against the
  real tbls output: legitimate content has no /-leading tokens.
- The completeness guard now sweeps information_schema.columns: every
  column must appear as a table cell of its own page, so an omitted
  column can't hide behind a page that merely exists (or the same word
  in prose).

Mutation-verified: an injected /work path fails the leak guard by name,
and a deleted column row fails the coverage guard naming the column
(first attempt deleted a nonexistent 'Notes' row and proved nothing —
the applied mutant is the one that counts).

Author: mforce

tests/Cluckwork.Api.IntegrationTests/SchemaDocsTests.cs

@@ -113,10 +113,16 @@ public void CommittedSchemaDocs_CarryNoEnvironmentSpecificContent()
         Assert.True(Directory.Exists(DocsDir),
             "docs/schema/ does not exist — run tools/schema-docs/generate.sh");
 
+        // The path rule is deliberately BROAD (any /-leading token, not a
+        // list of known prefixes): the generator's own /work container mount
+        // is identical on every machine, so a leak of it would survive the
+        // CI byte-diff — this guard is the only thing that can catch that
+        // class. Verified against the real tbls output: legitimate content
+        // contains no /-leading tokens at all.
         var leaks = new (string Name, Regex Pattern)[]
         {
-            ("absolute unix path", new Regex(@"(?:/home/|/tmp/|/Users/)")),
-            ("absolute windows path", new Regex(@"[A-Z]:\\")),
+            ("absolute unix path", new Regex(@"(?m)(?:^|[\s(""'`=])/[A-Za-z0-9._-]+(?:/[A-Za-z0-9._-]*)*")),
+            ("absolute windows path", new Regex(@"(?i)[a-z]:\\")),
             ("timestamp", new Regex(@"\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}")),
             ("connection URI (would carry the ephemeral password)", new Regex(@"postgres(?:ql)?://")),
         };
@@ -169,6 +175,26 @@ public async Task CommittedSchemaDocs_CoverEveryTableIndexAndCheckConstraint()
                 missing.AppendLine($"table without a doc page: {table}");
         }
 
+        // Column-level completeness: a page existing does not prove it lists
+        // every column. Each column must appear as a cell of its own table's
+        // page (the "| Name |" form tbls emits), so an omitted column can't
+        // hide behind the same word appearing in prose elsewhere.
+        var pageCache = new Dictionary<string, string>();
+        foreach (var row in await QueryPairsAsync(conn,
+            """
+            SELECT table_name, column_name FROM information_schema.columns
+            WHERE table_schema = 'public'
+            ORDER BY table_name, ordinal_position
+            """))
+        {
+            var page = Path.Combine(DocsDir, $"public.{row.Name}.md");
+            if (!File.Exists(page)) continue; // already reported above
+            if (!pageCache.TryGetValue(page, out var content))
+                pageCache[page] = content = File.ReadAllText(page);
+            if (!content.Contains($"| {row.Def} |", StringComparison.Ordinal))
+                missing.AppendLine($"column absent from its table page: {row.Name}.{row.Def}");
+        }
+
         foreach (var row in await QueryPairsAsync(conn,
             "SELECT indexname, indexdef FROM pg_indexes WHERE schemaname = 'public' ORDER BY indexname"))
         {

tools/schema-docs/generate.sh

@@ -57,10 +57,12 @@ done
 
 PORT="$(docker inspect -f '{{ (index (index .NetworkSettings.Ports "5432/tcp") 0).HostPort }}' "$PG")"
 
+# Always build — an existence check would happily reuse a stale assembly
+# after a migration was added and document the PREVIOUS schema as current.
+# The incremental build is near-free when everything is already fresh (CI's
+# Build step just ran; locally MSBuild skips up-to-date projects).
 APP_DLL="src/Cluckwork.Api/bin/Release/net10.0/Cluckwork.Api.dll"
-if [ ! -f "$APP_DLL" ]; then
-  dotnet build Cluckwork.sln --configuration Release
-fi
+dotnet build Cluckwork.sln --configuration Release
 
 # Testing environment — the same one the integration-test factory uses, and
 # for the same reason: not Development (which would pull the developer's