fix: address Devin review round 4 — bash arithmetic, CalVer max, docs

- smoke-test.sh: replace ((PASS++)) with PASS=$((PASS + 1)) to avoid
  set -e abort when counter is 0 (bash returns exit 1 for ((0)))
- CalVer: use max(N) from existing tags instead of count, safe when
  tags are deleted (e.g. deprecated version cleanup)
- CLAUDE.md: update schema version from v2 to v3

663 tests pass.

.github/workflows/release.yml

@@ -61,8 +61,9 @@ jobs:
           TAG_CLAIMED=false
           for ATTEMPT in 1 2 3 4 5; do
             git fetch --tags --force
-            EXISTING=$(git tag -l "*-${YEAR_MONTH}.*" | wc -l | tr -d ' ')
+            # Use max(N) not count — safe even if tags are deleted
-            N=$((EXISTING + 1))
+            MAX_N=$(git tag -l "*-${YEAR_MONTH}.*" | sed 's/.*\.//' | sort -n | tail -1)
+            N=$(( ${MAX_N:-0} + 1 ))
             VERSION="${YEAR_MONTH}.${N}"
             TAG="${CHANNEL}-${VERSION}"
 

CLAUDE.md

@@ -154,7 +154,7 @@ Auth providers in `app/auth/` (FastAPI-based):
 ## Key Implementation Details
 
 ### DuckDB Schema (src/db.py)
-- Schema v2 with auto-migration from v1
+- Schema v3 with auto-migration from v1→v2→v3
 - `table_registry`: id, name, source_type, bucket, source_table, query_mode, sync_schedule, etc.
 - `sync_state`, `sync_history`: track extraction progress
 - `users`, `dataset_permissions`, `audit_log`: auth + RBAC

scripts/smoke-test.sh

@@ -13,10 +13,10 @@ check() {
     local name="$1" ok="$2"
     if [ "$ok" = "true" ]; then
         echo "  PASS $name"
-        ((PASS++))
+        PASS=$((PASS + 1))
     else
         echo "  FAIL $name"
-        ((FAIL++))
+        FAIL=$((FAIL + 1))
     fi
 }