test(plugin-hono-server): make the localization pin's ObjectQL double honour where and the caller's bound

The double answered by object name and dropped `opts.limit`, so neither read it
serves could tell a bounded read from an unbounded one — and both carry a bound
(`sys_user` at 1, the grouped `sys_setting` `$in` read at 10). It now draws from
a row table, filters with a `where` matcher that refuses any operator it does not
implement, and applies the bound BY PRESENCE (`typeof opts?.limit === 'number'`)
AFTER the filter.

`check:objectql-double-limit` could not grade the old double at all: its deepest
binding strategy stubs every non-function declaration, the counter
`let sysUserReads = 0` became the gate's row-stub Proxy, and `++sysUserReads`
raised `TypeError: Cannot convert object to primitive value` — reported as
UNJUDGED, which the gate treats as debt rather than a skip. The double now seats
on the gate's control probe at the earlier binding strategy, so it is graded
CONFORMING (limit 3 -> 3 rows, 5 -> 5, 0 -> 0 of 7 matches) instead of throwing.
No baseline entry was added; the ledger never grows.

What the file ASSERTS is unchanged — all 13 cases pass, including the corrected
`timezone`/`currency` contract.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01D47qPfEWVPmhguWgBZCi5N

Author: claude

packages/plugins/plugin-hono-server/src/current-user-endpoints-localization.test.ts

@@ -94,30 +94,65 @@ interface MountOptions {
     failUserRead?: boolean;
 }
 
+/**
+ * The `where` shapes these endpoints actually issue: scalar equality
+ * (`{ id }`, `{ namespace }`, `{ scope }`) and the one `$in` list on `key` the
+ * grouped settings read carries. Anything else — a combinator, another
+ * operator — is REFUSED loudly rather than answered silently wrong, which is
+ * the cheap correct answer for a double that never sees one (the defect class
+ * `check:where-matcher` exists for is silence, not incompleteness).
+ */
+function matchesWhere(row: Row, where: Row | undefined): boolean {
+    for (const [key, condition] of Object.entries(where ?? {})) {
+        if (key.startsWith('$')) {
+            throw new Error(`this double does not implement the where operator ${key}`);
+        }
+        if (condition !== null && typeof condition === 'object') {
+            const operators = Object.keys(condition);
+            if (operators.length !== 1 || operators[0] !== '$in') {
+                throw new Error(`this double does not implement the where operator(s) ${operators.join(', ')} on ${key}`);
+            }
+            if (!condition.$in.includes(row[key])) return false;
+            continue;
+        }
+        if (row[key] !== condition) return false;
+    }
+    return true;
+}
+
 function mount({ storedLocale, rules = [LOCALE_SHAPE_RULE], settingLocale, settingTimezone, settingCurrency, authenticated = true, failUserRead = false }: MountOptions = {}) {
     const reads: Array<{ object: string; opts: any }> = [];
     let sysUserReads = 0;
+    /**
+     * The rows each read draws from, held as a table rather than assembled per
+     * branch, so the double answers `where` and the caller's `limit` the way
+     * the engine does instead of by object name.
+     */
+    const tables: Record<string, Row[]> = {
+        sys_user: [{ id: USER, email: 'lang@example.com', locale: storedLocale }],
+        // The endpoint reads all three `localization` keys in ONE `$in` query,
+        // so the table carries whichever of them the fixture configured — and
+        // nothing for the rest.
+        sys_setting: ([
+            ['locale', settingLocale],
+            ['timezone', settingTimezone],
+            ['currency', settingCurrency],
+        ] as Array<[string, string | undefined]>)
+            .filter(([, value]) => value !== undefined)
+            .map(([key, value]) => ({ namespace: 'localization', key, value, scope: 'tenant' })),
+    };
     const ql = {
         find: async (object: string, opts: any) => {
             reads.push({ object, opts });
-            if (object === 'sys_user') {
-                if (failUserRead && ++sysUserReads > 1) throw new Error('sys_user unavailable');
-                return opts?.where?.id === USER ? [{ id: USER, email: 'lang@example.com', locale: storedLocale }] : [];
-            }
-            if (object === 'sys_setting') {
-                // The endpoint reads all three `localization` keys in ONE `$in`
-                // query, so the double answers whichever of them the fixture
-                // configured — and nothing for the rest.
-                const configured: Array<[string, string | undefined]> = [
-                    ['locale', settingLocale],
-                    ['timezone', settingTimezone],
-                    ['currency', settingCurrency],
-                ];
-                return configured
-                    .filter(([, value]) => value !== undefined)
-                    .map(([key, value]) => ({ namespace: 'localization', key, value, scope: 'tenant' }));
-            }
-            return [];
+            if (object === 'sys_user' && failUserRead && ++sysUserReads > 1) throw new Error('sys_user unavailable');
+            // The caller's bound is applied BY PRESENCE and AFTER the filter.
+            // Both reads this double serves carry one — `sys_user` at 1, the
+            // grouped `sys_setting` read at 10 — so a double that dropped it
+            // could not tell a bounded read from an unbounded one, and every
+            // bound change on those reads would be green by construction
+            // (`check:objectql-double-limit`).
+            const matched = (tables[object] ?? []).filter((row) => matchesWhere(row, opts?.where));
+            return typeof opts?.limit === 'number' ? matched.slice(0, opts.limit) : matched;
         },
         // The registry view the endpoint reads the column's rule off.
         getSchema: (name: string) => (name === 'sys_user' && rules !== null ? { name: 'sys_user', validations: rules } : undefined),