@@ -357,6 +357,15 @@ Per finding: `file:line` → what → generated-equivalent exists? → recommend
 
     **A deferral must carry its measurement forward.** "Wire the names tier" is a real thing to postpone — on the observed estate it meant a new generated tier, a new dev-loop step, a new `verify --codegen` gate and edits to 4 service and 6 test modules that could only be validated against a live database, and the branch in hand deliberately changed nothing in the running application. That is a legitimate decision and belongs in the report. But record it with **the site count, the exact command that emits the artifact, and the modules that would change** — never as intent alone — and **re-raise it in every later audit until the ratio moves**. A deferral with no number attached reads as a nice-to-have on the next reading and silently becomes permanent; the one carrying `0/53` does not.
 
+
+12. **An "open JSON bag" whose readers all agree on a shape.** `field.string` + `@dbColumnType: jsonb` is SANCTIONED vocabulary, not a defect — it is the deliberate escape hatch for a genuinely untyped JSON column with no value object to reference, it emits `unknown` / `z.unknown()` by design, and a cross-port corpus (`fixtures/api-contract-conformance/jsonb/`) gates that contract. **Never flag the pattern on sight.** Flag it only when the bag is not actually open: when the consuming code demonstrably knows the shape and spells it out. The tell is a FIXED KEY SET — raw-SQL JSON-path reads (`->>'decision'`, `#>>'{a,b}'`), casts to a concrete type (`row.output as { draftText?: string }`), destructuring, or a hand-written validator over the parsed value. At that point the shape exists; it is simply declared in N readers instead of once in the metadata, which is drift signature 6 with zero declarations rather than several — and it is invisible to every gate, because `verify --db` sees a jsonb column that matches and `--codegen` sees generated files that are correct for an open bag.
+
+    **Measured on one estate:** 6 such columns, and one of them (`AuditEntry.output`) carried **12 distinct keys across 31 raw-SQL path reads plus 7 casts** in 10 files. Nothing in that is open. Estate-wide the pattern is common — 74 `field.string` + jsonb fields across five projects — which is exactly why the discriminator matters more than the count: report the ones whose readers pin a shape, not the ones whose readers treat the value as opaque.
+
+    **Do NOT flag:** a bag whose readers genuinely pass it through (logged, echoed, stored, forwarded to a third party) without reading a key; a third-party or LLM raw response whose shape is not the adopter's to declare; an **array of scalars**, which is `isArray: true` on the base subtype and never an object; a bag the metadata's own comment justifies as open with a reason.
+
+    **Remedy:** declare the shape as an `object.value` and point the field at it — `field.object` + `@objectRef` + `@storage: jsonb`. The column stays jsonb, so this is a codegen/contract change and not necessarily a migration; what changes is that `unknown` becomes a generated type, the casts delete, and the keys become metadata-owned — which also promotes their literals into drift signature 11's scope, where the `->>'key'` sites were previously exempt because the metadata owned nothing. **Verify the column type is genuinely unchanged before promising no migration**, and parity-gate each converted read against the raw-SQL one before deleting it. Convert one column at a time: the shape is a judgment per bag, and a wrong guess declares a contract the writers do not honor.
+
 ---
 
 ## Owned-codegen & scaffold-and-own assessment
 
@@ -272,6 +272,15 @@ subtypes with opposite polarity: `requirement.functional` fails when NOTHING imp
 
 ## Cross-cutting
 
+- **Open JSON bag vs a shape the readers already know (drift signature 12).** `field.string`
+  + `@dbColumnType: jsonb` is the SANCTIONED untyped-column escape hatch (emits `unknown`,
+  gated by `fixtures/api-contract-conformance/jsonb/`) — never a finding on sight. It is a
+  finding only when the consuming code pins a FIXED KEY SET: raw-SQL `->>'key'` reads, casts
+  to a concrete type, destructuring, a hand validator over the parsed value. Then the shape
+  exists and is declared in N readers instead of once. Remedy: an `object.value` +
+  `field.object` `@objectRef` `@storage: jsonb` — the column stays jsonb. Not a finding for a
+  pass-through bag, a third-party/LLM raw response, or an array of scalars (`isArray`).
+
 - **A metadata-derived value spelled a second time (drift signature 11 — one rule, not two halves).**
   A literal in non-generated code or config that must EQUAL a value the metadata declares or a
   generator derives is a second spelling. The constants to reference: `<Entity>Names` (physical
 
@@ -357,6 +357,15 @@ Per finding: `file:line` → what → generated-equivalent exists? → recommend
 
     **A deferral must carry its measurement forward.** "Wire the names tier" is a real thing to postpone — on the observed estate it meant a new generated tier, a new dev-loop step, a new `verify --codegen` gate and edits to 4 service and 6 test modules that could only be validated against a live database, and the branch in hand deliberately changed nothing in the running application. That is a legitimate decision and belongs in the report. But record it with **the site count, the exact command that emits the artifact, and the modules that would change** — never as intent alone — and **re-raise it in every later audit until the ratio moves**. A deferral with no number attached reads as a nice-to-have on the next reading and silently becomes permanent; the one carrying `0/53` does not.
 
+
+12. **An "open JSON bag" whose readers all agree on a shape.** `field.string` + `@dbColumnType: jsonb` is SANCTIONED vocabulary, not a defect — it is the deliberate escape hatch for a genuinely untyped JSON column with no value object to reference, it emits `unknown` / `z.unknown()` by design, and a cross-port corpus (`fixtures/api-contract-conformance/jsonb/`) gates that contract. **Never flag the pattern on sight.** Flag it only when the bag is not actually open: when the consuming code demonstrably knows the shape and spells it out. The tell is a FIXED KEY SET — raw-SQL JSON-path reads (`->>'decision'`, `#>>'{a,b}'`), casts to a concrete type (`row.output as { draftText?: string }`), destructuring, or a hand-written validator over the parsed value. At that point the shape exists; it is simply declared in N readers instead of once in the metadata, which is drift signature 6 with zero declarations rather than several — and it is invisible to every gate, because `verify --db` sees a jsonb column that matches and `--codegen` sees generated files that are correct for an open bag.
+
+    **Measured on one estate:** 6 such columns, and one of them (`AuditEntry.output`) carried **12 distinct keys across 31 raw-SQL path reads plus 7 casts** in 10 files. Nothing in that is open. Estate-wide the pattern is common — 74 `field.string` + jsonb fields across five projects — which is exactly why the discriminator matters more than the count: report the ones whose readers pin a shape, not the ones whose readers treat the value as opaque.
+
+    **Do NOT flag:** a bag whose readers genuinely pass it through (logged, echoed, stored, forwarded to a third party) without reading a key; a third-party or LLM raw response whose shape is not the adopter's to declare; an **array of scalars**, which is `isArray: true` on the base subtype and never an object; a bag the metadata's own comment justifies as open with a reason.
+
+    **Remedy:** declare the shape as an `object.value` and point the field at it — `field.object` + `@objectRef` + `@storage: jsonb`. The column stays jsonb, so this is a codegen/contract change and not necessarily a migration; what changes is that `unknown` becomes a generated type, the casts delete, and the keys become metadata-owned — which also promotes their literals into drift signature 11's scope, where the `->>'key'` sites were previously exempt because the metadata owned nothing. **Verify the column type is genuinely unchanged before promising no migration**, and parity-gate each converted read against the raw-SQL one before deleting it. Convert one column at a time: the shape is a judgment per bag, and a wrong guess declares a contract the writers do not honor.
+
 ---
 
 ## Owned-codegen & scaffold-and-own assessment
 
@@ -272,6 +272,15 @@ subtypes with opposite polarity: `requirement.functional` fails when NOTHING imp
 
 ## Cross-cutting
 
+- **Open JSON bag vs a shape the readers already know (drift signature 12).** `field.string`
+  + `@dbColumnType: jsonb` is the SANCTIONED untyped-column escape hatch (emits `unknown`,
+  gated by `fixtures/api-contract-conformance/jsonb/`) — never a finding on sight. It is a
+  finding only when the consuming code pins a FIXED KEY SET: raw-SQL `->>'key'` reads, casts
+  to a concrete type, destructuring, a hand validator over the parsed value. Then the shape
+  exists and is declared in N readers instead of once. Remedy: an `object.value` +
+  `field.object` `@objectRef` `@storage: jsonb` — the column stays jsonb. Not a finding for a
+  pass-through bag, a third-party/LLM raw response, or an array of scalars (`isArray`).
+
 - **A metadata-derived value spelled a second time (drift signature 11 — one rule, not two halves).**
   A literal in non-generated code or config that must EQUAL a value the metadata declares or a
   generator derives is a second spelling. The constants to reference: `<Entity>Names` (physical
 
@@ -357,6 +357,15 @@ Per finding: `file:line` → what → generated-equivalent exists? → recommend
 
     **A deferral must carry its measurement forward.** "Wire the names tier" is a real thing to postpone — on the observed estate it meant a new generated tier, a new dev-loop step, a new `verify --codegen` gate and edits to 4 service and 6 test modules that could only be validated against a live database, and the branch in hand deliberately changed nothing in the running application. That is a legitimate decision and belongs in the report. But record it with **the site count, the exact command that emits the artifact, and the modules that would change** — never as intent alone — and **re-raise it in every later audit until the ratio moves**. A deferral with no number attached reads as a nice-to-have on the next reading and silently becomes permanent; the one carrying `0/53` does not.
 
+
+12. **An "open JSON bag" whose readers all agree on a shape.** `field.string` + `@dbColumnType: jsonb` is SANCTIONED vocabulary, not a defect — it is the deliberate escape hatch for a genuinely untyped JSON column with no value object to reference, it emits `unknown` / `z.unknown()` by design, and a cross-port corpus (`fixtures/api-contract-conformance/jsonb/`) gates that contract. **Never flag the pattern on sight.** Flag it only when the bag is not actually open: when the consuming code demonstrably knows the shape and spells it out. The tell is a FIXED KEY SET — raw-SQL JSON-path reads (`->>'decision'`, `#>>'{a,b}'`), casts to a concrete type (`row.output as { draftText?: string }`), destructuring, or a hand-written validator over the parsed value. At that point the shape exists; it is simply declared in N readers instead of once in the metadata, which is drift signature 6 with zero declarations rather than several — and it is invisible to every gate, because `verify --db` sees a jsonb column that matches and `--codegen` sees generated files that are correct for an open bag.
+
+    **Measured on one estate:** 6 such columns, and one of them (`AuditEntry.output`) carried **12 distinct keys across 31 raw-SQL path reads plus 7 casts** in 10 files. Nothing in that is open. Estate-wide the pattern is common — 74 `field.string` + jsonb fields across five projects — which is exactly why the discriminator matters more than the count: report the ones whose readers pin a shape, not the ones whose readers treat the value as opaque.
+
+    **Do NOT flag:** a bag whose readers genuinely pass it through (logged, echoed, stored, forwarded to a third party) without reading a key; a third-party or LLM raw response whose shape is not the adopter's to declare; an **array of scalars**, which is `isArray: true` on the base subtype and never an object; a bag the metadata's own comment justifies as open with a reason.
+
+    **Remedy:** declare the shape as an `object.value` and point the field at it — `field.object` + `@objectRef` + `@storage: jsonb`. The column stays jsonb, so this is a codegen/contract change and not necessarily a migration; what changes is that `unknown` becomes a generated type, the casts delete, and the keys become metadata-owned — which also promotes their literals into drift signature 11's scope, where the `->>'key'` sites were previously exempt because the metadata owned nothing. **Verify the column type is genuinely unchanged before promising no migration**, and parity-gate each converted read against the raw-SQL one before deleting it. Convert one column at a time: the shape is a judgment per bag, and a wrong guess declares a contract the writers do not honor.
+
 ---
 
 ## Owned-codegen & scaffold-and-own assessment
 
@@ -272,6 +272,15 @@ subtypes with opposite polarity: `requirement.functional` fails when NOTHING imp
 
 ## Cross-cutting
 
+- **Open JSON bag vs a shape the readers already know (drift signature 12).** `field.string`
+  + `@dbColumnType: jsonb` is the SANCTIONED untyped-column escape hatch (emits `unknown`,
+  gated by `fixtures/api-contract-conformance/jsonb/`) — never a finding on sight. It is a
+  finding only when the consuming code pins a FIXED KEY SET: raw-SQL `->>'key'` reads, casts
+  to a concrete type, destructuring, a hand validator over the parsed value. Then the shape
+  exists and is declared in N readers instead of once. Remedy: an `object.value` +
+  `field.object` `@objectRef` `@storage: jsonb` — the column stays jsonb. Not a finding for a
+  pass-through bag, a third-party/LLM raw response, or an array of scalars (`isArray`).
+
 - **A metadata-derived value spelled a second time (drift signature 11 — one rule, not two halves).**
   A literal in non-generated code or config that must EQUAL a value the metadata declares or a
   generator derives is a second spelling. The constants to reference: `<Entity>Names` (physical
 
@@ -357,6 +357,15 @@ Per finding: `file:line` → what → generated-equivalent exists? → recommend
 
     **A deferral must carry its measurement forward.** "Wire the names tier" is a real thing to postpone — on the observed estate it meant a new generated tier, a new dev-loop step, a new `verify --codegen` gate and edits to 4 service and 6 test modules that could only be validated against a live database, and the branch in hand deliberately changed nothing in the running application. That is a legitimate decision and belongs in the report. But record it with **the site count, the exact command that emits the artifact, and the modules that would change** — never as intent alone — and **re-raise it in every later audit until the ratio moves**. A deferral with no number attached reads as a nice-to-have on the next reading and silently becomes permanent; the one carrying `0/53` does not.
 
+
+12. **An "open JSON bag" whose readers all agree on a shape.** `field.string` + `@dbColumnType: jsonb` is SANCTIONED vocabulary, not a defect — it is the deliberate escape hatch for a genuinely untyped JSON column with no value object to reference, it emits `unknown` / `z.unknown()` by design, and a cross-port corpus (`fixtures/api-contract-conformance/jsonb/`) gates that contract. **Never flag the pattern on sight.** Flag it only when the bag is not actually open: when the consuming code demonstrably knows the shape and spells it out. The tell is a FIXED KEY SET — raw-SQL JSON-path reads (`->>'decision'`, `#>>'{a,b}'`), casts to a concrete type (`row.output as { draftText?: string }`), destructuring, or a hand-written validator over the parsed value. At that point the shape exists; it is simply declared in N readers instead of once in the metadata, which is drift signature 6 with zero declarations rather than several — and it is invisible to every gate, because `verify --db` sees a jsonb column that matches and `--codegen` sees generated files that are correct for an open bag.
+
+    **Measured on one estate:** 6 such columns, and one of them (`AuditEntry.output`) carried **12 distinct keys across 31 raw-SQL path reads plus 7 casts** in 10 files. Nothing in that is open. Estate-wide the pattern is common — 74 `field.string` + jsonb fields across five projects — which is exactly why the discriminator matters more than the count: report the ones whose readers pin a shape, not the ones whose readers treat the value as opaque.
+
+    **Do NOT flag:** a bag whose readers genuinely pass it through (logged, echoed, stored, forwarded to a third party) without reading a key; a third-party or LLM raw response whose shape is not the adopter's to declare; an **array of scalars**, which is `isArray: true` on the base subtype and never an object; a bag the metadata's own comment justifies as open with a reason.
+
+    **Remedy:** declare the shape as an `object.value` and point the field at it — `field.object` + `@objectRef` + `@storage: jsonb`. The column stays jsonb, so this is a codegen/contract change and not necessarily a migration; what changes is that `unknown` becomes a generated type, the casts delete, and the keys become metadata-owned — which also promotes their literals into drift signature 11's scope, where the `->>'key'` sites were previously exempt because the metadata owned nothing. **Verify the column type is genuinely unchanged before promising no migration**, and parity-gate each converted read against the raw-SQL one before deleting it. Convert one column at a time: the shape is a judgment per bag, and a wrong guess declares a contract the writers do not honor.
+
 ---
 
 ## Owned-codegen & scaffold-and-own assessment
 
@@ -272,6 +272,15 @@ subtypes with opposite polarity: `requirement.functional` fails when NOTHING imp
 
 ## Cross-cutting
 
+- **Open JSON bag vs a shape the readers already know (drift signature 12).** `field.string`
+  + `@dbColumnType: jsonb` is the SANCTIONED untyped-column escape hatch (emits `unknown`,
+  gated by `fixtures/api-contract-conformance/jsonb/`) — never a finding on sight. It is a
+  finding only when the consuming code pins a FIXED KEY SET: raw-SQL `->>'key'` reads, casts
+  to a concrete type, destructuring, a hand validator over the parsed value. Then the shape
+  exists and is declared in N readers instead of once. Remedy: an `object.value` +
+  `field.object` `@objectRef` `@storage: jsonb` — the column stays jsonb. Not a finding for a
+  pass-through bag, a third-party/LLM raw response, or an array of scalars (`isArray`).
+
 - **A metadata-derived value spelled a second time (drift signature 11 — one rule, not two halves).**
   A literal in non-generated code or config that must EQUAL a value the metadata declares or a
   generator derives is a second spelling. The constants to reference: `<Entity>Names` (physical