Backmerge wave: Zealot → template (#75 Waves 1–2)

[agreenspan]

Executes the Wave 1 + Wave 2 items from #75 (the Zealot→template backmerge tracker), same mechanic as #70. One commit per item, then a merge of today's main and a scope cut per review on 2026-09-17.

Wave 1 — standalone

• isUniqueConstraintError + isWriteConflictError (7d3c6b86): duck-typed P2002/P2034 narrowing in packages/db/src/utils/; error middleware uses both (P2002 → 409 exists, P2034 → 409 write conflict, P2025 → 404).
• withRetry (2b55363c, cherry-picked from Zealot #1510): exponential backoff with isRetryable matcher, packages/shared/src/utils/retry.ts + tests.
• unregisterDbHook (a4811ef5, Zealot #1510): registrations recorded by name so a single hook can be removed — previously the only removal API was clearHookRegistry(), which nukes production hooks, so a test-registered hook leaked across bun's single-process suite unremovably. Coexists with main's registerDbInvariant/unregisterDbInvariant and bridged stores. +3 registry tests.
• ws pubsub publish-always-through-Redis (fd22c5cc, Zealot #1682): publish() gated on pubsubEnabled, which only the API server entry ever set — a job handler emitting a websocket handoff delivered into the worker's empty local registry and silently vanished. Publish now always goes through Redis; subscribing remains the socket-holding process's job. Includes Zealot's round-trip proof test.
  • Test-seam fix this surfaced: in tests, getRedisSub() returned the same shared RedisMock instance as the general client, so the first subscribe put the whole suite's Redis into subscriber mode. The test subscriber is now a duplicate() of the shared mock.

Wave 2 — CI rules (scripts/ci/rules/**)

• no-select-on-mutations (Zealot #1610): brace-aware bun detector + rule (diff-mode vs base branch) + fixtures. A narrowed write result breaks the after-write hooks. The sweep fixed two real write sites: createToken omitted keyHash at the write, and sendEmail's communicationLog.createManyAndReturn selected {id, idempotencyKey}. Both now take the full row and shape afterwards. Runtime guard dropped per review — this is a code-shape rule and the CI script is the enforcement.
• env-override test seam + no-test-env-mutation (2c69d03b, Zealot #1510): reshaped for this repo — here process.env is the config (env.ts replaces it with the parsed schema), so the registry lives in @template/shared/utils (setEnvOverride / resetEnvOverrides / withEnv) and the proxy wraps process.env itself: installed by env.ts in test mode for apps/api, and by a root bunfig preload for package suites. Global afterEach backstops clear overrides between tests. All mutating test files converted, including main's newer redis/client.test.ts and the mid-drain shutdown test. The CI rule bans env.X = … / process.env.X = … in tests across apps + packages.
• no-raw-transaction, no-direct-bulk-writes, no-direct-prisma-in-tests, awk no-prisma-maps (30ddd73e):
  • raw $transaction banned outside packages/db/src/client.ts. Repo scan: clean.
  • createMany/updateMany banned in favor of the hook-firing *AndReturn variants. Repo scan: clean.
  • factories-only in tests, diff-mode: legacy direct-create sites converge as files get touched. packages/db/src/test/** exempt. New jobOutboxFactory + drain.test.ts converted.
  • no-prisma-maps upgraded to Zealot's model-block awk parser: enum-value @map allowed, field/table maps still banned.

Moved out (2026-09-17 review)

• Rate limiting — clientIp trusted-hop util and the incrementFixedWindows Lua window are pulled from this PR and land with the full port of Zealot's rule-composition limiter (identity + context buckets, Retry-After, fail-open) in a dedicated PR. middleware/rateLimit.ts is back to main's state here.
• The email test files that predated main's data.* rule vocabulary were dropped in the merge; main's versions stand.

Validation (after merging main at 4da32f00)

• typecheck green on every workspace (sdk needs generate:sdk in a fresh worktree — staleness, unrelated)
• bun run test: permissions 81, db 305, email 474, api 1102 — 0 fail
• all scripts/ci/rules/*.sh pass on the merged tree
• biome: no findings on touched files

Closes the Wave 1 + Wave 2 checklists on #75.

🤖 Generated with Claude Code