[kvlonge]

Why

sqb format silently left files unformatted whenever its safety checks failed, so --check passed on SQL it never formatted; on a large real project that was about 40% of files. Join keys computed inside ON and free-form terminal CTE names also passed every Rule.

Changes

• Formatter: any decline is a named format-unsafe fault (file and reason); format and --check exit non-zero and a declined file is left entirely unchanged.
• Formatter: preserve authored literal, cast, dollar-quote, JSON-path, function and interpolation spelling around canonical layout; one line per CTE-producing macro call; comments stay attached; complexity budget shared with the compiler.
• SQBRSQL040: JOIN ON must compare plain columns (literals, ranges, IS NULL, USING, ON TRUE allowed; functions, casts, arithmetic, variant paths flagged).
• SQBRSQL041: the last top-level CTE is named final and no other CTE uses that name; fixes wrapped root queries in SQBRSQL035.
• Docs recommend family selection; playground passes both new Rules.

Upgrade: format --check now reports files that were previously skipped (run sqb format once). Family selectors (SQBRSQL, SQBR) gain the two new Rules; exact-code lists are unaffected.

Verification

• make test (7,673 passed) and make check-ci; focused formatter and Rule suites.
• Real project (1,337 files): declines 544 → 1; formatting every file then compiling showed zero dependency or lineage changes across 1,016 models.
• Independent review and follow-up; all findings fixed.