Residue from the v2 removal and #823: contradictory shipped skills, db push references, wizard sweep gaps

[tobyhede]

Cleanup checklist from auditing #772 (EQL v2 removal) and #823 (add-only rewriter). Every item shares one root cause: a change updated one copy of something and left the other. All verified present on main (c8b1325a). One PR should cover the lot.

Shared file with #836 — land this one first. Both issues edit the same paragraph, skills/stash-drizzle/SKILL.md:64. This issue owns deleting the false "data-destroying" claim, which is wrong today and needs no design decision. #836 later adds post-sweep reconciliation guidance to the same paragraph, pending a decision there. Editing in the other order silently reverts this correction.

Shipped skills contradict each other in the customer's repo

SKILL_MAP.drizzle (packages/cli/src/commands/init/lib/install-skills.ts:14) installs stash-encryption, stash-drizzle, stash-indexing and stash-cli together, and skills/ ships inside the stash tarball. So these two pairs land side by side and disagree.

• skills/stash-drizzle/SKILL.md:64 still says the sweep's repair "is data-destroying, so it is safe only on an empty table" and that for a table with live data you must "not apply the swept migration". Make the Drizzle EQL migration rewriter non-destructive and fail closed #823 made the rewrite add-only, so this is false — and skills/stash-cli/SKILL.md:379 states the opposite correctly ("while preserving the source column… The rewrite never emits DROP COLUMN or RENAME COLUMN"). Make the Drizzle EQL migration rewriter non-destructive and fail closed #823 updated only the stash-cli copy. A correcting commit already exists but was never pushed: e3695929 on the local fix/issue-813 branch, on no remote.
• skills/stash-encryption/SKILL.md:12 says an older EQL v2 schema surface "with chainable capability builders still exists for existing deployments". :1015 of the same file says "The v2 builders and the @cipherstash/stack/client subpath have been removed", which matches the code after feat(stack): make encryption authoring v3-only #829, and :201 says "there is no chainable capability tuner". The :12 pointer resolves to a section that asserts its opposite.

db push residue in wizard source and tests

stash db push was removed with the Proxy lifecycle (#814 / #825). packages/wizard/src/lib/post-agent.ts:58 now says the retired command "must never run", but these still name it:

• packages/wizard/src/run.ts:243 — user-visible string: 'Package install, \eql install, db push, and migrations finished.'printed under "Post-agent steps complete", for a step that never runsdb push.
• packages/wizard/src/agent/__tests__/interface.test.ts:91-92 — it('allows stash db push', …)
• packages/wizard/src/__tests__/interface.test.ts:148 — expect(wizardCanUseTool('Bash', { command: 'npx stash db push' })).toBe(true)
• packages/wizard/src/__tests__/format.test.ts:74 — '2. Run \npx stash db push' fixture

Note the allowlist itself is correct and should not change: packages/wizard/src/agent/interface.ts:58,81 allow the 'stash db' prefix, which still serves db validate, db migrate and db test-connection. These are stale examples documenting a removed subcommand, not a behavioural defect.

(packages/wizard/README.md and packages/stack/README.md carry the same residue but are tracked under #816's "reconcile … READMEs" criterion, not here.)

Wizard sweep: reporting gap the CLI copy does not have

• packages/wizard/src/lib/post-agent.ts:159-165 — when a directory's sweep throws, the continue at :164 skips the reporting block at :167-172, so the wizard never names the files it rewrote before the failure. The data is available: sweepMigrationDirs propagates it at packages/wizard/src/lib/rewrite-migrations.ts:947-952. The CLI does report it (packages/cli/src/commands/eql/migration.ts:316-321, "Rewrote N migration file(s) before the sweep stopped"). Low severity — the SQL is additive and post-agent.ts:81-85 throws before the migrate prompt, so nothing unreviewed runs. Named as a known residual in Drizzle sweep: partial-write-then-throw is reported as unverified, not destructive #786's closing comment.

Moved to #836**:** the unchecked err as Partial<RewriteSweepError> cast at packages/wizard/src/lib/rewrite-migrations.ts:946 was originally listed here. It is a fail-closed correctness defect — a non-object throw raises a TypeError inside the catch and escapes sweepMigrationDirs — and does not belong in a cleanup checklist alongside cosmetic test fixtures. Tracked as item 3 of #836.

Changesets

stash patch (skills ship in the tarball), @cipherstash/wizard patch, @cipherstash/stack patch if the stash-encryption wording change is scoped there.