AbramsOS

- migration 0017 review_draft (keyed to purchase, additive, UNIQUE(purchase,target))
- lib/reviews/{drafts,model,executors}: draft generation (short product names, variety, deslop) from purchase.raw_extract, DB-backed, content-seal on approve
- routes/reviews.js + views/reviews.ejs: /reviews batch-review page (read all, select, approve-in-one-pass), paced per-item gated posting (no bulk fire, no auto-approve)
- gated edge: openclaw resolves product by search (email receipts carry no ASIN) -> needs_verify (human submits); George sends approved seller emails; REVIEWS_EXECUTORS_LIVE + approve + seal + confirm required
- nav link, review id prefix
- 74 drafts generated from 37 real Amazon purchases; posted:0; executors OFF by default

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QA2Se1HgCv8KSZbUQD6w2p

1. grounding: extract person-names uniformly for every scope + merge household
   roster; grounded payees/providers/merchants/reminder titles now redacted
   on external lanes (was vitals-only).
2. redact: whitespace/separator/case normalization before name pass; broadened
   address (apt/city/ST/ZIP, PO Box, short/hyphenated), SSN (spaces+labeled),
   intl phone, odd-grouped card, unlabeled+extra-labeled IDs. Benign order#/
   merchant/product still survive.
3. routes/chat.js: fail CLOSED — no req.userId -> 401; removed DEV_USER_ID.
4. claude-cli: wrap user/context in <user_input> delimiters + neutralize forged
   role-label lines so injected turns are inert (Gemini unaffected).
5. claude-cli: spawn with minimal allowlist env instead of full-inherit-then-
   delete; DB_/AWS_/OPENAI secrets no longer leak to the child.
6. chat.js: persistent 'informational only' disclaimer on every assistant bubble
   + interstitial confirm before first external-model send on the vitals agent.

11 new golden regression tests; npm test 126/126 (1 pre-existing skip).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

- lib/chat-registry.js: single source of truth for models (Gemini 2.5 Flash/Pro,
  Ollama qwen3/hermes3, Claude CLI) + 7 agent personas with data-scopes
- lib/chat-redact.js: PII redaction boundary (email/phone/SSN/card/NDC/MRN/
  address/named-people) applied to every external-lane prompt
- lib/chat-grounding.js: read-only per-agent record grounding via lib/db.js
- lib/chat-providers/*: gemini (Generative Language API), ollama (local, graceful
  degrade), claude-cli (spawn with ANTHROPIC keys stripped, no shell injection)
- routes/chat.js: POST /api/chat + GET /api/chat/registry, one audit_log row per
  call, read/answer only (no state-changing or external actions)
- views/partials/chat.ejs + footer wiring: chat inherits on every page
- public/js/chat.js + app.css: pickers, spec cards, lane badge, session history
- tests/chat.test.js: redaction golden fixture + registry + route auth-gate

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

The launchd plist injects only PG_*; without GEORGE_URL/GEORGE_BASIC_AUTH the
corpus refresh skipped as 'GEORGE_URL unset' even after a token reconnect.
Loading .env (WorkingDirectory=repo root) gives the headless watch the George
creds; dotenv never overrides the plist-set PG_* vars.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Removes the watch's hard dependency on a connected Gmail OAuth *connector*
row (connector_account has 0 rows), which made it SKIP silently and never
ingest. New autonomous design:
- lib/mode-corpus.js: best-effort refresh of the local Mode corpus from Gmail
  via the George HTTP bridge; NON-BREAKING (George down / stale bridge auth /
  steve-personal invalid_grant all return {ok:false,reason} + surface a gated
  reconnect signal, never throw).
- mode-claims-watch.js: refresh -> ALWAYS run the corpus ingester (idempotent)
  -> stage fill-not-submit briefs for eligible claims. No OAuth required.
- ingest-mode-claims-corpus.js: glob every data/mode-emails-*.js shard so
  George-refreshed mailers are picked up without editing the script.
- Fixes the person.address bug: query selected a non-existent 'address'
  column (silently caught -> empty profile, so briefs lost name/email/phone
  too). Now reads metadata_jsonb->>'address'. Never submits; never fabricates.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Commit 8aca6e8 (app-level Basic Auth) intercepted the session-auth/CSRF
smoke tests with 401 before route logic, and .env's SINGLE_USER_AUTOLOGIN
auto-logged-in the owner so the 'auth-gated' tests saw 200 instead of 302.
Both are production/fleet concerns, not what these tests validate. Overriding
APP_BASIC_AUTH=0 + SINGLE_USER_AUTOLOGIN= in the test script restores the
suite to green (110/111 pass, 1 pre-existing pdf-fixture skip). Production
keeps Basic Auth (NODE_ENV=production) + nginx + autologin unchanged.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Cody catch: unconditional post 4x/day would flood the parking-lot board.
Also replace global fetch() with http.request() for Node 18 compat.

- George 401 (missing GEORGE_BASIC_AUTH) no longer masks fill as 'FAILED'
- Alert failures log as WARN so fill success is visible
- Add CNCP parking-lot fallback: urgent claims (deadline ≤7d) posted to
  http://localhost:3333 automatically, no George cred needed

- header.ejs: topbar -> sticky left .sidebar (vertical scroll nav, brand top, sign-out+theme bottom); adds /settlements (+ Claims) to the nav; client-side active-link highlight
- footer.ejs: close the new content-wrap/applayout wrappers
- app.css: .applayout flex + .sidebar/.sidenav rules + <=860px row-wrap fallback

Mirror the :9801 approvals scoreGate engine on the AbramsOS settlements page:
per-claim 0-5 ratings (value/urgency/ease/win-likelihood), composite priority
(value*2.4 + urgency*2.4 + ease*1.0 + win*0.4), high/med/low tier. Rank open
claims priority-first with rank badge, tier chip, rating bars, $/deadline/proof
pills; show recently-expired separately. New lib/settlement-score.js (pure/
deterministic); scores computed server-side in the route, passed to the EJS view.
Eligibility controls + fill-not-submit staging button unchanged.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

- lib/mode-claims.js: deterministic parser for the Mode Class Actions newsletter
  (handles Mode's swapped-URL quirk via slug↔name token matching)
- 0016_settlement_claims.sql: settlement_claim + settlement_fill_job tables
- ingest-mode-claims.js: native Gmail-connector ingester (idempotent, $0)
- openclaw-claim-filler.js: builds a portal-driver brief that PREFILLS and STOPS
  at the perjury attestation/submit; only for eligibility_state='eligible'
- mode-claims-watch.js + launchd (15m): 'as soon as email lands' trigger
- /settlements dashboard: eligibility toggle + gated 'Prefill via openclaw'
- 6-month Dan backfill artifact: 19 distinct settlements, 12 open

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

- middleware/rate-limit.js: hand-rolled in-memory limiter (no dep), 12/15min/IP,
  429+Retry-After. Applied to POST /signin, /signup, /step-up. Verified: 12 ok then 429.
- clientMeta now logs req.ip (trust-proxy-resolved real client) not the raw leftmost
  X-Forwarded-For (attacker-controllable) — audit-log IP integrity.
/yoloforever cycle 3. Cody's 'XFF-spoof bypasses the limiter' CRITICAL was DISPROVEN
empirically (spoofed XFF still 429 — nginx appends real peer right; trust proxy:1 picks
it); only the audit-log (leftmost-XFF) read was the real issue. HSTS already sent by helmet.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

- /healthz returns {ok} only (drop pid + err.message); full error logged server-side.
- Global error handler renders a generic client message; internal err.message no
  longer leaks (Postgres schema etc.) to the internet. Full detail still logged.
Keepalive still gets 200. /yoloforever cycle 2; verified healthz+auth intact.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

- trust proxy=1 (behind Kamatera nginx) so req.secure reflects X-Forwarded-Proto.
- Session + CSRF cookies now secure:req.secure — Secure over HTTPS subdomain,
  plain over direct tailnet http (no lockout). Closes cookie-in-transit leak on
  the now-public claims.abramsos.agentabrams.com PII surface.
- Records the deployed nginx vhost (45.61.58.125:80/443 -> 100.82.17.107:9774).
Found by /yoloforever cycle-1 contrarian gate; verified Secure-on-https / plain-on-http.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

- New unclaimed_property table (migration 0015) + seed of 5 CA properties
  found for Steve on claimit.ca.gov ($131.55, status=staged). Public data
  only, no SSN.
- /claims now renders a Tracked Properties table (amount/holder/address/
  property-id drill hrefs, found date+time chip, per-row status select).
- API: GET /api/unclaimed, POST /api/unclaimed/:id/status (session-scoped
  write, audited, CSRF-exempt like other /api routes).
- server.js: claims.abramsos.agentabrams.com/ -> /claims host redirect.
- DNS + live deploy left gated (memo in pending-approval).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Overnight life-optimizer build: health (vitals/insights/BP-meds/reminders), savings
(advisor/coupons/bill-audit/reorder-timing), Assets+RentCast, Neighborhood Watch,
Biometrics, Plaid+CSV banking, Withings device sync, 38 real Amazon purchases ($8,966.66).

- lib/withings-client.js: Withings Health API OAuth (authUrl/exchange/refresh) + getMeasures mapping (type 1=weight kg→lb, 9/10=BP pair, 11=HR, 54=SpO2); handles refresh-token rotation; graceful no-creds
- routes/withings.js: /auth/withings → consent → /api/withings/callback stores encrypted token in connector_account (provider=withings) + initial sync; /api/withings/sync re-syncs (dedup via health_reading external_id); reuses vitals.insertReadings; audited medical
- connectors.ejs: 'Health devices' section — Connect Withings / Sync now / setup-needed
- server.js wiring + .env WITHINGS_* (gated). One-set-of-creds-from-working

- lib/home-value.js: RentCast AVM lookup by address; graceful no-key/no-address (never fabricates a value); Zillow API retired so RentCast is the free option
- routes/assets.js: POST /api/assets/:id/estimate → fills current_value + value_source='estimate' + range; valuationConfigured flag
- views/assets.ejs: 'Estimate' button on property cards (prompts for key if absent)
- .env: RENTCAST_API_KEY= (gated)
- DATA: opened remaining 17 older Amazon orders via George → all 37 now have real totals; complete all-time spend $8,966.66 (2022-2026)

- lib/bill-audit.js: category-aware — NEVER flags essentials (tax/rent/utility/loan); insurance/phone/internet get 'shop your rate'; discretionary/subscriptions ALWAYS surface with annual cost ('still using this?'), LLM (gemma3:12b) refines cancel/downgrade/overpriced; rule-based duplicate detector
- lib/reorder-timing.js: deterministic 'reorder soon' nudges from cadence + last_ordered (Paper towels due-now verified)
- wired both into /api/savings/run + nightly runner; kind='bill-audit'/'reorder-timing' surface on /savings
- honest: est_savings only for cancel/downgrade, never for 'review'; verified on synthetic sub then wiped

- 0014_biometrics.sql: person_biometric (1:1 per person) — DOB, sex, height, weight, blood type, eye/hair, marks, allergies, conditions, emergency contact, prints-on-file (child-ID)
- lib/biometrics.js: exact age + BMI; adult CDC BMI category; kids link to CDC percentile calculator (NO fabricated percentile)
- routes/biometrics.js upsert-per-person + views/biometrics.ejs profile cards w/ inline edit, child badges
- nav + wiring. Sensitive PII, audited; works for whole household

- lib/neighborhood.js: free OSM Nominatim geocoder (no key) + categorized real deep-link builder (Your Ring first: cameras live-view + Neighbors feed), geo-aware SpotCrime/OSM links
- routes/neighborhood.js: /neighborhood resolves address from ?asset/?address/first property; /api/neighborhood/geocode
- views/neighborhood.ejs: address+radius controls, Leaflet map w/ radius circle, property picker, link cards
- nav + wiring; links to Assets property addresses

- 0013_assets.sql: asset table (property/vehicle/account/valuable) w/ address, current_value, category, details, notes, geocode
- routes/assets.js + views/assets.ejs: /assets dashboard (net worth total + by-category stat row, add form, created date+time chips, per-property 'Watch' link to neighborhood)
- nav + wiring. Values user-entered (auto-valuation API is a later gated add). Feeds upcoming neighborhood-watch via property address

- lib/vitals-reminders.js: fires 'time for a BP check' only if a person logged BP before but not in 14d; deduped via reminder engine
- reminder-engine.generateForUser hooks it in alongside returns/warranty/recall reminders
- verified: lapsed(20d)=fire, recent(2d)=skip, never-logged=skip

- lib/bp-meds.js: deterministic classifier (curated generic stems + names -> effect/class; never LLM-guessed) — ACE/ARB/beta-blocker/CCB/diuretic (lowers) + NSAID/decongestant/steroid/stimulant (raises)
- routes/vitals.js: read-only join to medication table, bpRelevant() into /health
- views/vitals.ejs: 'Medications that affect blood pressure' panel (color-coded lowers/raises), informational-not-advice
- works when med list is populated (currently empty)

- lib/vitals-insights.js: computeTrends (this-30d vs prior-30d avgs), recheckFlag (deterministic rule, gentle), summarize (gemma3:12b narrates ONLY computed deltas — never invents readings; no medical advice)
- routes/vitals.js: fast trends+recheck on /health load; /api/health/insights for async LLM narrative
- views/vitals.ejs: 'This month' panel (trend chips + delta arrows + recheck banner + async narrative) + weight/RHR sparklines
- verified end-to-end on synthetic data then wiped; empty-state safe (no fabricated readings)

- scripts/collect-amazon-orders.js: parsed order confirmations 2022-2026, dedup on order#, total NULL (not fabricated — needs body enrichment)
- validates savings seeds: Nespresso Vertuo = top recurring buy (4x), shipping labels (2x)
- feeds home purchase count + /purchases + savings advisor with REAL data

- csv-parser: headerless fallback (WF/Quicken export: date,amount,*,,description) + signMode — WF debits are negative=spend, so normalize to positive + drop deposits; header CSVs unchanged
- upload.js: dedup key (csv:date:amount:merchant) + ON CONFLICT so re-uploading overlapping statements doesn't double
- connectors.ejs: 'Import CSV' upload form with WF download instructions — zero third-party signup path
- answers Steve: Plaid needs a free web signup (no CLI); CSV upload needs nothing

- views/connectors.ejs: Plaid Link flow — connect button, secure login (Plaid handles bank creds), exchange, per-bank sync; graceful 'setup needed' state when keys absent
- routes/plaid.js: GET /api/plaid/status; sync now resumes from persisted cursor + ON CONFLICT dedup (was re-pulling everything each sync -> dup purchases)
- lib/plaid-client.js: isConfigured() helper
- 0012_plaid_sync_cursor.sql: connector_account.sync_cursor + unique(user_id,order_number) on purchase
- Plaid (not Stripe) is correct for reading a bank; sandbox works now, real Wells Fargo needs Steve's prod keys

- 0011_health_readings.sql: health_reading (BP pairs, HR, weight, SpO2, glucose...) w/ dedup index
- lib/health-metrics.js: AHA BP categorization + Apple Health export.xml streaming parser (pairs systolic/diastolic by timestamp; scales SpO2)
- routes/vitals.js + views/vitals.ejs: /health dashboard w/ inline SVG BP chart, AHA color categories, per-person filter, manual add, delete; /api/health/readings JSON ingest for the Health Auto Export app
- scripts/import-apple-health.js: one-command import of an Apple Health export
- nav + wiring. NO fabricated readings — table ships empty w/ 3 real sync paths. Verified end-to-end on synthetic data then wiped.

- scripts/run-savings-advisor.js: dotenv-loaded, dedup-safe regen (local, $0)
- deploy/com.steve.abramsos-savings.plist: daily 6:05am, RunAtLoad off; bootstrap surfaced in header comment

- home: 'Savings ideas' stat tile (open count + est $ total) linking to /savings
- seeded 3 real verifiable savings mechanisms (Amazon Subscribe & Save, camelcamelcamel price alerts, Costco coupon book) — real URLs, no fabricated codes

- 0010_savings.sql: savings_suggestion + merchant_coupon tables
- lib/savings-advisor.js: grounded strategy suggestions (no hallucinated SKUs/prices)
- routes/savings.js + views/savings.ejs: dashboard w/ created date+time chips, sort+density, save/dismiss
- seeded reorder items from real Amazon email history; 4 suggestions generated
- switched local model qwen3:14b->gemma3:12b (qwen3 thinking-mode returns empty under format:json)

- scripts/ndc-recall-check.js: match each fill's 11-digit package NDC to openFDA product NDC
  (leading-zero-normalized labeler|product, exact-confirmed); 4/46 NDCs on a recall list, 40 fills
- recalls tab: prominent 'Your actual products on an FDA recall list' NDC section (headline signal)
- Rx tab: red RECALL badge on flagged fills (CREON, Fluticasone, Nystatin, Atorvastatin)

- scripts/check-fda-recalls.js: cleans OCR junk from fill drug names (95 fixed), rebuilds
  deduped medication list (83->36 real meds) with generic names, cross-references each vs
  openFDA drug-enforcement (free); 33/36 matched, 300 recall records into medication_recall
- routes/recalls.js + views/recalls.ejs: new 'Medication recalls (FDA)' section, grouped per
  med, Class I/II/III severity badges, worst-first; labeled advisory (ingredient-level match)

- 0009_prescription_fills.sql: fill-history table (date/drug/rx/qty/days/doctor/plan/plan-paid, raw OCR audit)
- scripts/load-abrams-rx.js: OCR-parsed loader, reconciled to doc totals (Natalia 220 fills / $136,254.86 of $136,328.74)
- creates person Steve (self) + Natalia (spouse); dedupes 83 medications into medication table
- routes/prescriptions.js + views/prescriptions.ejs: read-only viewer w/ per-person totals + filter; nav 'Rx'

- migration 0008: person, medication, medication_recall
- /household — add spouse/dependents (records + meds attach to them)
- /medications — self-entered meds per person; every write audit-logged with a medical-consent marker (AGENTS.md gate)
- lib/fda-fetcher.js — openFDA drug-enforcement lookup; per-med + "check all" recall scan stores matches, surfaced on the card
- nav links, recall styling

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

pretest builds/migrates/seeds a throwaway abrams_os_test (schema + all migrations
+ seed.sql + rights-rules); test script pins PG_DATABASE=abrams_os_test. Stops the
auth-e2e test from wiping the real owner account on every `npm test` (AGENTS.md rule).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

sendDigest short-circuits when there are no upcoming deadlines, so empty days
don't put a "nothing due" email in the inbox.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

- lib/digest.js builds an HTML digest (overdue / this week / coming up) and self-sends to Steve's own inbox via George /api/send (internal recipient, no external-send token)
- scheduler cron 08:00 America/Los_Angeles is DOUBLE-GATED: off unless DIGEST_ENABLED=1 AND GEORGE_BASIC_AUTH set; committed code is dormant and never auto-sends on its own
- .env.example documents all digest keys (default DIGEST_ENABLED=0)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

- /warranties + /api/warranties CRUD (audit-logged) writing to service_commitment (source='manual')
- reminder-engine scans service_commitment.refund_window_ends_at -> 'coverage_window_closing' deadlines
- nav link, warranty id prefix

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

- /bills, /reorders CRUD (audit-logged) + /deadlines over the reminder engine
- add-forms, mark-paid/ordered (rolls due date forward + refreshes deadline), created date+time chip on every admin card
- generalized sort-density.js to any [data-grid]; nav links; liquid-glass styles

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

- 0007 migration: bill (Bills to Pay incl. tax/government/CRA via category) + reorder_item (frequently-ordered + best-price savings)
- lib/recurrence.js: pure cadence date math (+ 5 passing unit tests)
- reminder-engine emits calendar_reminder rows for upcoming bill due-dates and reorder points (unified Deadlines)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitignore now excludes *.bak, *.bak.*, *.pre-*, *.orig, *~ so editor
swap files and pre-edit snapshots can't be accidentally committed and
end up served from /public. Backstop in server.js: any GET whose path
matches those patterns short-circuits to 404 before express.static,
so even a stray on-disk *.bak.html can never leak.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

CPSC notice + cited-rule source links now use rel="noopener noreferrer"
instead of bare rel="noopener" so we don't leak Referer to upstream pages.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

- 7 new golden-file fixtures in tests/fixtures/receipts/ (Amazon, Best Buy,
  DoorDash, Apple, Etsy, Uber, Walmart, plus a non-receipt newsletter)
- tests/extractor-regression.test.js auto-discovers fixtures and asserts
  merchant + total + orderNumber + minConfidence per file
- lib/receipt-extractor.js: 2 surgical heuristic fixes uncovered by fixtures
  · extractTotal now picks the highest-rank label ("order total" >
    "grand total" > "total charged" > plain "total"); allows up to 40 chars
    between label and $amount (handles "Total charged to Visa ••1234: $18.42");
    rejects "subtotal" via 3-char lookbehind
  · extractOrderNumber adds Best-Buy-style "Order #: BBY01-806589123456"
    (alpha prefix + digits) and a tighter Amazon-only pattern
- 15/15 tests across the regression + base extractor suites

- npm install multer
- lib/csv-parser.js: parses statement-style CSVs
  · auto-detects date / amount / merchant columns (case-insensitive)
  · handles quoted fields with embedded commas, dollar signs, parens-as-negative
  · skips refunds (negative amounts) and bad rows; reports first 5 errors
- routes/upload.js: POST /api/upload/csv (multer in-memory, 10 MB cap)
  → parser → INSERT purchase rows + audit_log entries
- 10/10 csv-parser tests

- lib/compliance-guardian.js: 4 layered defenses
  · isAllowedDestination(url) — outbound HTTP allowlist (gov, NIH/FDA,
    Plaid, Google APIs, local LLM endpoints; subdomain-confusion safe)
  · detectPromptInjection(txt) — 16 patterns (ignore-prior-instructions,
    chatml fragments, role injection, exfiltration phrasing, code-eval)
  · redactPii(text) — masks card #, SSN, phone, email local-part, ZIP,
    Stripe/OpenAI-style API keys; keeps domain hints
  · guardForLlm(text) — one-shot redact+scan combiner
- lib/receipt-extractor.js: enrichWithLlm now runs guardForLlm() on body+from+
  subject before sending to Ollama; refuses enrichment if injection detected
  (returns heuristic with llmError='compliance_guardian_blocked')
- tests/compliance-guardian.test.js: 19/19 across allowlist (6), injection (4),
  redactor (6), one-shot guard (3)

- routes/connectors.js syncDrive(): after a Drive PDF lands in document table,
  immediately calls pdf.parseFile() + receipt-extractor (heuristic + LLM).
  Inserts a purchase row when extractor returns a draft.
- Images skipped (OCR is a later tick); failed parses flip parsed_status='failed'
- audit_log gets document_parsed + purchase_extracted (source: 'drive_pdf')
- 34/35 tests still green

- tests/crypto.test.js (7): AES-256-GCM round-trip, IV uniqueness, tamper
  detection on ciphertext + auth tag, unicode, empty-string, env-var validation
- tests/ids.test.js (6): prefix per kind, unknown-kind throws, distinctness,
  ULID monotonic-over-time, lowercase invariant
- 13/13 green; pure unit tests, no PG, no server

- routes/recalls.js: GET /recalls (HTML), GET /api/recalls (JSON)
  · joins recall_match × recall_event × purchase
  · status filter (pending_review/confirmed/dismissed) with chip-counts
- views/recalls.ejs: confidence-coded cards (red ≥85%, amber otherwise)
  with CPSC source link
- nav: /recalls added between /claims and /audit
- 2 new tests (auth-gate + API-gate)