fix/job-active

updateWithVersion WHERE clause omits version — OCC is unenforced

domains/utility/src/utility-contract/utility-contract.queries.ts:383

The WHERE clause is `WHERE id = $id` only. `currentVersion` is used in the SET clause (`version: currentVersion + 1`) but NOT in the WHERE filter. The guard added in this diff — `if (!demotedRow) return err(...)` — can therefore only fire if the row is hard-deleted mid-transaction, which never occurs in normal pipeline flow. It cannot detect a concurrent version bump. To make OCC work as described, add `.where(and(eq(utilityContracts.id, id), eq(utilityContracts.version, currentVersion)))` to the UPDATE. Pre-existing bug, but the new comment ('a silent null here would commit BOTH rows active') is misleading without this fix.

TerminateAndReplace demotion write lacks the same null guard

domains/utility/src/utility-contract/utility-contract.shells.ts

The TerminateAndReplace branch calls `await contractQueries.updateWithVersion(tx, oldContract.id, { status: 'terminated' }, oldContract.version)` and discards the return value without a null check (line ~924). If this update returns null, the new contract is still inserted while the old one remains active — the same two-active corruption the Reactivate branch guard is meant to prevent. The fix was applied selectively; the sibling branch has the same gap.

databaseError('update') wrong semantic for an OCC / version-conflict case

domains/utility/src/utility-contract/utility-contract.shells.ts:873

When updateWithVersion returns null the correct cause is an OCC conflict or row-gone, not a database infrastructure failure. `ContractErrors.databaseError('update')` maps to statusCode 500 and `_tag: ContractDatabaseError`, but `ContractErrors.versionConflict(...)` (409) is the right type. This mislabels a business-level conflict as an infra error and will mislead handlers and on-call engineers reading logs. Pre-existing pattern elsewhere in the file, but the diff doubles down on it — if OCC is going to be enforced here, the error type should be corrected too.

Comment block is longer than convention requires

domains/utility/src/utility-contract/utility-contract.shells.ts:865

The four-line comment narrates what the code does and restates the PR's motivation. Project convention: only add a comment when the WHY is non-obvious, one short line max. The invariant being protected ('demotion null-check prevents two-active') could be a single line, or omitted entirely since the guard matches the pattern already established for the reactivation write above it.

OCC failure path on demotion write has no test coverage

domains/utility/src/utility-contract/__tests__/ensure-contract-evidence.integration.test.ts

The `if (!demotedRow)` branch in ensureContractFromBillsShell is never exercised. No test forces updateWithVersion to return null on the demotion call, so the transaction-rollback invariant (reactivation is also undone when demotion fails) is unverified. Once the WHERE clause is fixed to enforce OCC, a test should inject a version conflict on the demoted row to prove the atomic rollback.

uniq('TAR') in test body comment could mislead future readers

domains/cross-domain/src/__tests__/cfe-job-intent.integration.test.ts

Line `tariffCode: uniq('TAR'), // tariff 1's code — the terminated row's regime` is correct (uniq() appends the shared testTimestamp, so the string is identical to the one used in beforeAll). A reader unfamiliar with uniq()'s determinism might think a random new code is being generated. A note like '// same as beforeAll tariff1.code — uniq() uses fixed testTimestamp' would remove the ambiguity.

demotedRow captured but value never consumed after null check

domains/utility/src/utility-contract/utility-contract.shells.ts:869

const demotedRow = await contractQueries.updateWithVersion(...) captures the returned entity, but the value is never used after the null guard — all downstream code uses the pre-fetched `demoted` object. Using `if (!await contractQueries.updateWithVersion(...)) { ... }` directly (or prefixing with `void`) would signal intentionally that the returned value is not needed.