🤖 Claude review

Replaces the regex-based named-argument binder (bindNamedRe) with a byte scanner that reuses the shared bindQuoteState, and extends that state machine to also protect SQL comments — single-line (--, #/#!) and nested block (/* */) comments — so ?, $N and @name markers inside comments, string literals, and quoted identifiers are no longer substituted. This is the follow-up to #1879, completing the named-binding case (including backticks and comments).

Verdict: approve. The implementation is clean, well-commented, and internally consistent across all four binders. bind() is the single shared path (query_parameters.go:60), so the fix applies to both the native and database/sql surfaces and to both protocol paths (binding runs before transport).

Things I verified:

• Escaping semantics are preserved — \? stays verbatim inside identifier quotes and comments, but is unescaped to a literal ? inside single-quoted strings and raw text, matching pre-PR behavior.
• bindNamed still reports genuinely-missing params: lastMatchIndex is advanced even for unbound placeholders, so the have no arg error path remains reachable (covered by TestBindNamedUnbound).
• The quote/comment contexts are mutually exclusive, and the removal of the regexp import / bindNamedRe is safe (no other references).

Blind spots:

• I could not exercise these against a live ClickHouse server. The correctness of nested /* */ handling rests on ClickHouse actually nesting block comments; if it does not, content after the first */ that the server treats as live SQL would have its placeholders left unbound (a fail-loud query error, not silent corruption). Worth a quick confirmation.
• Tests live in bind_test.go (appropriate, since bind is a pure function) rather than tests/issues/; there is no issue number for this follow-up.

Verdict: ✅ Approve

General findings

• 💡 Nit — nit: broaden comment test coverage (named/numeric nesting, #!)
  The new tests are solid, but a few branches are only exercised for the positional binder:

  • Nested /* */ is tested only in TestBindPositionalComments; add an equivalent case to TestBindNumericComments and TestBindNamedQuotedContexts so the blockComment depth logic is covered for $N and @name too.
  • The #! shebang-style comment variant is mentioned in the update comment but never tested — only bare # is. One case with #! would lock in that behavior.
  • Consider t.Run(asset.query, ...) (or an explicit message on assert.Equal) so a failing case names the offending input, per the project's table-driven test convention.

  None of these block the PR.

_{Inline comments are attached to the relevant lines. This summary updates in place on re-review.}