feat(engine)!: findOne, update and delete declare what they answer, and their hook seams are guarded (#16231)

[os-musk]

Fixes #16231

Clause-②: yes

Executes the maintainer ruling on #16231 — option A, 「同意」, director seat summon #17, decision batch #2, comment 5572153316. Options B (declare only, no enforcement) and C (record any as intended) were refused there and nothing here reopens them.

Angle brackets do not survive this body's sanitizer, so declared types are spelled with square brackets, the same convention the card uses: Promise[Record[string, any] | null] is the real generic.

What this changes

engine.ts has four return hookContext.result sites, one per hook-bearing verb. #15823 closed the find() one — an afterFind handler that replaced the array made a method declared Promise[any[]] resolve to an envelope, silently — and recorded that it could close only that one, because the other three declared Promise[any] and carried nothing a handler could break. A guard cannot exist before a declaration worth guarding does. This PR writes the three declarations down and then closes their seams.

verb	declared before	declared now	where the shape comes from
findOne	Promise[any]	Promise[Record[string, any] | null]	driver.findOne → Promise[Record[string, unknown] | null]
update	Promise[any]	Promise[Record[string, any] | number | null]	by-id driver.update → record-or-null; predicate driver.updateMany → affected count (#4639)
delete	Promise[any]	Promise[boolean | number]	by-id driver.delete → boolean; predicate driver.deleteMany → affected count

⭐ The shapes were derived from the code, not from an assumed symmetry with findOne. update and delete each have TWO driver exits and the dispatch ladder (resolveEngineUpdateDispatch / its delete twin) picks between them, which is exactly why their declaration is a UNION and findOne's is not. engine.ts states the predicate half in its own prose at the branch that feeds the realtime publish — the sentence cites #4639 and reads: "A predicate update … an affected-row COUNT, which the strip skips as a non-object." (The verb between those two words is a closing keyword, so it is elided here rather than parked beside a card number.)

⚠️ Row FIELD values stay erased (Record[string, any], not Record[string, unknown]). That is #15823's precedent extended exactly rather than softened: find() declares Promise[any[]], so the CONTAINER is the contract and the rows inside are any. It is also the only spelling that can state "record or null" at all, since any | null collapses to any in TypeScript. The strict alternative was measured and is reported on the card as a strictly larger option.

The census — done FIRST, posted on the card before any declaration shipped

The maintainer accepted ruling A on a stated precondition: count the consumers whose compilation the narrowing breaks, and post the number on the card. Discharged in comment 5578614790.

18 files · 92 compile errors, measured by compiling all 31 workspace packages twice:

• control — turbo run typecheck --continue on the unmodified worktree at origin/main 5e53d73d83: 142 tasks, 142 successful, exit 0. A clean baseline, so every treatment error is attributable.
• treatment — the same command with the declarations narrowed: 136 successful, 6 failed.
• 3 non-test src files / 9 sites; 15 test-and-pin files / 83 errors. ⭐ A census scoped to non-test sources would have said 3 files and been wrong by a factor of six — the pins are where this contract is encoded.
• The dominant signature is TS18047: 'row' is possibly 'null': the null check the declaration exists to force.
• objectstack-ai/objectui, cloned at 67299bf43b: 0 consumers (386 files import @objectstack/spec — the positive control fires — and zero name IDataEngine, IObjectQLEngine, IScopedObjectRepository or IScopedContext). objectstack-ai/cloud is not reachable by this session and is unmeasured; so are npm consumers outside the org.

Every one of the 92 is repaired here.

A second drift class the GUARD found, that the type could not

Four test doubles answered shapes their own IDataDriver contract does not have, invisible while the engine door said any:

• { deleted: 1 } / { deleted: 0 } from delete / deleteMany — packages/spec/src/contracts/data-engine.test.ts, packages/runtime/src/seed-loader.test.ts, packages/objectql/src/engine-filter-tokens.test.ts
• an ARRAY of rows from updateMany, which declares Promise[number] — packages/objectql/src/plugin.integration.test.ts (two doubles)
• undefined from a bare vi.fn() on update / delete — packages/objectql/src/engine.test.ts (two doubles)

All repaired to the declared shapes, and the { deleted: n } envelope now has a pin of its own so it cannot come back.

⚠️ That discovery changed the refusal's wording, and the change is load-bearing. find()'s refusal can say "your handler replaced ctx.result" because the value at that seam always comes from driver.find, which every driver answers with an array. These three verbs have exits that can answer off-contract themselves, so the sentence now names the SEAM and accuses nobody — "after the 'afterUpdate' dispatch 'ctx.result' is undefined" — and developerMessage names BOTH possible sources. A sentence blaming the handler would have sent four of the repairs above to the wrong file.

Symbols re-derived on origin/main, with firing controls

The card's own anchors (:9565 / :9784 / :12103 / :13537, at bdc02182b) had all drifted, so everything was re-derived by symbol via git show origin/main:..., never from a working tree.

• Firing control: hookContext occurs 116 times in engine.ts, which is 15,020 lines — both matching the dispatch's stated readings exactly.
• four return hookContext.result sites: :9599, :9818, :12137, :13572
• find :9439 → Promise[any[]]; findOne :9705, update :10871, delete :13089 → all Promise[any]
• packages/spec/src/contracts/data-engine.ts :276 / :278 / :279; scoped-context.ts :148 / :164

The surface the ruling does not name — reported, not absorbed

ObjectRepository at engine.ts :14498+ is the same contract, not a separate one: export class ObjectRepository implements IScopedObjectRepository, the very interface the ruling names at scoped-context.ts:148/164. But narrowing the interface does not narrow the class, because TypeScript's implements accepts Promise[any] against any declared return — any is assignable in both directions.

That matters because ScopedContext.object(name): ObjectRepository returns the class, and ScopedContext IS HookContext.api. ⇒ a hook author writing ctx.api.object('task').findOne(...) still reads any after this PR; only a consumer who annotates the api as IScopedContext gets the narrowed answer. ⛔ Not fixed here — it needs its own consumer census, and widening this PR to take it is what the dispatch forbade. Same for IScopedObjectRepository.updateById (scoped-context.ts:167), still Promise[any]; the ruling names :148/164 and not :167.

Verification

Two-leg ablation, blob-hash-verified restore, measured at c5935b2445 — this patch round touched no file in verb-hook-result-shape.ts's closure, so the reading stands as taken and is stamped rather than restated as if re-run. The three shape predicates in verb-hook-result-shape.ts were mutated to always answer "legal".

• ⚠️ Two earlier attempts are reported rather than hidden. The first mutation did not COMPILE (TS6133, an unused symbol), so dist never carried it and ablation-dist-preflight correctly said ABSENT. The second compiled but carried its marker in a // comment, which the bundler strips — again ABSENT. Only the third, whose marker is a live string literal read through .length, is the measurement below.
• mutate leg: marker on disk 0 → 3 · blob eb59c5c9… → 352bd54d… · pnpm --filter @objectstack/objectql build exit 0 · ablation-dist-preflight … ABLATION_16231_GUARD_DISABLED → ✓ marker present in 4 built files, exit 0 · pin suite 15 failed | 14 passed (29).
• restore leg: git checkout HEAD -- PATH · RESTORE ok: blob eb59c5c9e87e67ceb0371bb3084d85ec70338310 == HEAD · git diff HEAD for the path EMPTY · preflight --absent → ✓ marker absent from all 14 built files and ✓ tree: working tree clean against HEAD, exit 0 · pin suite 29 passed (29).
• ⭐ The 14 that stayed green are held by DESIGN, and that is the correct reading, not a broken ablation. They are exactly the "declared limbs are answerable" cases (7), the "shaping stays legal" cases (5) and the vocabulary cases (2) — none of which exercises a refusal. Every one of the 15 refusal cases went red. The layer holding those 14 is the ENGINE's own dispatch and the driver contract, which the guard does not create and must not disturb; a guard-ablation that reddened them would mean the guard had taken over behaviour it only checks.

Tests, working tree clean on each measurement. Every row but one was measured after the commit c5935b2445, and this patch round changes no file those packages compile. @objectstack/spec IS re-measured, on the current head 10d7a9f1d9, because this round adds three cases to packages/spec/src/contracts/data-engine.test.ts:

package	result
@objectstack/objectql	286 files / 4837 passed, 0 skipped
@objectstack/spec	465 files / 12955 passed, 0 skipped — re-measured on 10d7a9f1d9; 12952 at c5935b2445, and the +3 are this round's F2 pins
@objectstack/metadata	52 files / 797 passed, 0 skipped
@objectstack/metadata-protocol	169 passed + 2 skipped files / 2433 passed + 10 skipped tests
@objectstack/plugin-auth	104 files / 2191 passed, 0 skipped
@objectstack/plugin-approvals	42 files / 705 passed, 0 skipped
@objectstack/rest	192 files / 3241 passed, 0 skipped
@objectstack/runtime	240 files / 3340 passed, 0 skipped
@objectstack/service-automation	125 files / 1486 passed, 0 skipped

⚠️ The skipped faces, named and counted — 2 files, 10 tests, both environment-gated on OS_TEST_MYSQL_URL and unrelated to this change: src/migrations/seed-tenancy-backfill.live-mysql.test.ts (5) and src/migrations/sys-setting-identity-index.live-mysql.test.ts (5), both describe.skipIf(!MYSQL_URL).

typecheck legs. tsc --noEmit and the per-package check:test-typecheck ratchet both ran. The ratchet is the leg that matters here, because it sees the test layer the plain build does not: @objectstack/objectql OK (44 files / 242 errors / 69 pinned signatures held), @objectstack/spec OK (54 / 261 / 145), @objectstack/runtime OK (27 / 191 / 69). @objectstack/service-automation compiles its tests through plain tsc --noEmit, which went from 30 errors to exit 0.

Gate reconciliation — derived and re-run in full on the FINAL head 10d7a9f1d9 (node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --ran RANFILE, exit 0). Verbatim:

Run reconciliation — 111 derived, 111 run, 0 NOT-MEASURED, 0 UNRUN.
✓ dispatch-gates --ran: 111 derived famil(ies) accounted for — 111 run, 0 NOT-MEASURED.

⛔ What that block is — and what an earlier revision of this body claimed it was. It reconciles COVERAGE: which derived families were run. It says nothing about VERDICTS. This body previously read “…, with all 111 exiting 0” beside it and offered the pair as this PR's gate evidence. The correction is to state what was actually measured, in two parts.

1. A gate's exit 0 is not automatically a reading. check:changeset-no-major run locally has no $GITHUB_EVENT_PATH, so it reads no clause-② declaration and does not judge the level axis at all — and it says so while exiting 0. Measured on head 10d7a9f1d9, verbatim from the gate:

ℹ️ LEVEL AXIS: NOT MEASURED — no clause-② declaration was readable for this PR, so whether `patch` fits the surface was not judged. This is neither a pass nor a failure (#4690).

⇒ that exit 0 sat inside the “all 111 exiting 0” count while the axis it names was RED on CI. The level axis was NOT MEASURED locally, and no local union run can measure it.

2. The verdicts, stated separately from the coverage, on head 10d7a9f1d9: 110 of the 111 exited 0 on the first pass. pnpm check:type-check-debt exited 3 — PREREQUISITE NOT MET, after an OOM under --max-old-space-size=4096 — which is ⛔ NOT MEASURED and never a pass. Re-run at 8192 (the gate pins tsc itself at 6144) it exited 0 with a real reading: 5 ledger entr(ies) re-measured in 177.5s, 55 raw tsc error(s) total, none above its recorded number. ⇒ 111/111 exit 0, one of them only on the second attempt.

The level axis, measured directly. The gate accepts --event, so the axis IS locally measurable once handed the payload CI reads. Same command on every leg, with this PR's real label set and Clause-②: yes.

GREEN on head 10d7a9f1d9 — exit 0:

✓ LEVEL AXIS: this PR declares clause-② `yes`, and no package whose `packages/*/src/**` it moves is graded `patch`.
   · carrier: `needs:contract-review` IS on this PR

RED on the same tree with the three consumer entries regraded patch — exit 1:

⛔ This PR declares clause-② YES and grades a package it grew `patch`.
     - @objectstack/metadata: patch   ← this PR moves @objectstack/metadata's packages/*/src/**
     - @objectstack/metadata-protocol: patch   ← this PR moves @objectstack/metadata-protocol's packages/*/src/**

⚠️ The red leg had to be COMMITTED to be visible: this gate reads changeset content through git show REV:PATH, so a working-tree edit is invisible to it. A first attempt mutated only the working tree, the gate stayed green, and that reading is reported void rather than quoted. Redone on a throwaway detached-HEAD commit (f45635a6a8), never pushed; branch ref and working tree verified unmoved afterwards.

⛔ That green does NOT grade @objectstack/plugin-auth. The red leg names TWO offenders while THREE entries were regraded. PUBLISHED_SOURCE_PATH (check-changeset-no-major.mjs:822) is anchored one directory deep, and this PR's plugin-auth path is packages/plugins/plugin-auth/src/objectql-adapter.ts — a level deeper — so that package never enters the grown set at all. That is #16713. The third entry reads minor because the rule says so, not because any gate confirmed it, and ⛔ this green must not be cited as covering it.

⚠️ The union was re-run on the final head deliberately: the ratchet families (check:type-check-debt, check:type-check-coverage, check:test-source-alias, check:cross-package-test-inputs, check:dual-build-cjs-loads, check:engine-double-contract) measure the tree, so a late commit moves exactly the readings a stale run would have quoted.

⚠️ The derivation itself ran on a STALE TREE, and said so. dispatch-gates reported this branch at least 64 commits behind origin/main, with 21 of the files it derives families FROM changed across that range — in its own words, “a well-formed answer about a tree nobody is on”. The 111 above is therefore this branch's family list, not current main's. Closing that gap is F7 of the contract review; the patch-round table below says why it is not done here.

The first derivation named 88; regenerating content/docs/references/** (the error-code ledger gained three codes) grew the change set and the re-derivation named 111. The extra 23 were run and reconciled. Two went red and were fixed rather than argued: @objectstack/spec check:docs (generated docs out of date — regenerated with gen:schema && gen:docs) and check:doc-authoring (a tracker id had landed inside a runtime string, which reaches operators who cannot resolve one). ⛔ On that run neither check:type-check-debt nor check:dual-build-cjs-loads refused with PREREQUISITE NOT MET: both ran on a fully built closure and reported real measurements (5 ledger entries re-measured, 55 raw tsc errors, none above its recorded number; entries/packages/cjsFiles/probes 104/67/620/1 vs floors 90/58/520/1). ⚠️ On the 10d7a9f1d9 re-run check:type-check-debt DID refuse once, under a 4 GB heap — measured and resolved in part 2 above; the two readings are about two runs, not a contradiction.

Changeset level, and the text it is based on

minor for @objectstack/spec and @objectstack/objectql, and — since F1 of the contract review — minor for the three repaired consumers as well, with the **BREAKING** banner and an ADR-0087 disposition. ⚠️ This paragraph read patch for the consumers until 951369f510; that grading is what F1 refused.

• Governing text — the one this level is based on: the WHICH LEVEL maintainer ruling of 2026-09-04 (decision batch [WIP] Add query enhancements and advanced validation features #35, on finding(changeset): two independent contract reviews read the repo's own history to opposite bumps for "add an exported symbol to a published index" #15294), recorded at .github/workflows/pr-automation.yml: "During the launch window major stays refused by check-changeset-no-major and breaking-ness is carried by the BREAKING banner plus the ADR-0087 disposition, not by the level", and "A purely additive widening of a published package's public surface … takes at least minor" — which this PR is on its own, since it adds three exported error classes, their codes and their shape predicates to @objectstack/objectql's index.
• Text REJECTED as the ceiling: AGENTS.md's "a bug fix in a released package takes a patch changeset — never none". That is the floor against none, not a ceiling, and reading it as one would have shipped this at patch.
• ⛔ A green from check-changeset-no-major is not by itself the justification: its level axis has a measured blind spot for nested package dirs (carded as [finding] The changeset LEVEL axis is blind to every NESTED package: packages/*/src/** matches one segment, so 51 of 74 workspace packages (all drivers/services/adapters) can pair Clause-②: yes with patch and stay green #16713). packages/spec/* and packages/objectql/* do match it, so it genuinely grades this one — but the argument above is the reason, not the gate.
• ADR-0087 disposition: not-required (no-migration-prescription). Nothing authorable moves — no spec key, no authored metadata property, no accepted request shape, nothing for objectstack migrate meta to rewrite. ⚠️ type-surface-only is the category built for exactly this class and it is not claimed, because its predicate 2 (no-spec-diff) is mechanically false here: the surface the ruling names IS packages/spec/src/contracts/**. Reported below rather than worked around, and ⛔ the **BREAKING** token is carried rather than dropped — dropping it is the erosion [finding] check-adr-0087-registration has no honest disposition for a published TYPE-surface narrowing — every category is refused, so the class is pushed to drop the **BREAKING** token instead #13080 was filed to stop.

Contract-review patch round — handoff 5582311948

The isolated CONTRACT_REVIEW_TIER review (comment 5580313505) returned CHANGES REQUIRED, and the re-review of 951369f51 (card comment 5586349339) restated what is still owed before undraft. Both sets, and where each item stands:

item	what the handoff asked	state
F1	raise the three consumer entries to minor, and correct this body's “111 run, all exit 0” claim	both halves discharged — levels at 951369f510; the body correction is under Verification above
F2	a type-level pin for the three declarations under check:test-typecheck	discharged — packages/spec/src/contracts/data-engine.test.ts
F3	per-door runtime FROM/TO lines naming both sources	discharged — .changeset/engine-verb-result-declarations.md
F6	file the two follow-up cards, cite them here	discharged — both already open: #16786, #16787, now cited in 验收备注 below
F7	merge main	no longer owed — dropped by the re-review below, which reads mergeable_state: clean; note kept for the record
N1	the body still said patch for the consumers, and still claimed the 111-family run covered the head while the test table was stamped c5935b2445	discharged — both counts, above
F4 / F5	notes, no change owed	untouched

F2, measured in both directions. Three @ts-expect-error cases read the declared member type through IDataEngine[…], so no new engine double is introduced. They are enforced by check:test-typecheck and never by vitest, which strips types without resolving them — the #5286 mechanism that made eighteen pins in this repo phantom checks.

• as shipped — exit 0: 54 file(s) / 261 error(s) / 145 pinned signature(s) held, identical to the reading before the pins ⇒ they add zero errors to an EXACT ledger.
• ablated, all three declarations reverted to Promise[any] and proved on disk (each anchor 1 → 0, injected marker 0 → 3, blob 7907f0e2… → 6b7b43bf…) — exit 1:

  • src/contracts/data-engine.test.ts: 3 type error(s) carrying a signature the ledger does not
    record — ARRIVED: TS2578: Unused '@ts-expect-error' directive.

• restored — git checkout HEAD -- PATH; blob back to 7907f0e2… == HEAD, and git diff HEAD for the path EMPTY.

⇒ reverting ruling A's DECLARATION half now reddens a gate. Before this round it reddened nothing anywhere, which is exactly what F2 named (ADR-0049).

F3. The changeset's runtime half was one sentence covering three doors, and it named only the handler. It is now three FROM/TO lines, one per door, each naming BOTH sources — an after* handler that assigned an off-declaration value, and a DRIVER whose own exit answered off IDataDriver — which is what each refusal's developerMessage already names. The driver limbs cited are read off packages/spec/src/contracts/data-driver.ts: findOne :181 and by-id update :198 (record-or-null), delete :209 (boolean), updateMany :266 / deleteMany :269 (affected count).

F7 — not done here, and no longer owed. The first handoff asked for main to be merged in, while this round's dispatch forbade it unless a conflict actually blocked an edit — “⛔ do not merge main in unless a conflict actually blocks an edit” — and none did. That conflict is now moot: the re-review of 951369f51 (card comment 5586349339, 2026-09-08) does not carry F7 in its owed set and reads mergeable_state: clean with CI 32 success / 0 failure. ⚠️ What does NOT go away is the measured consequence, kept above deliberately: the LOCAL family derivation still ran on a tree at least 64 commits behind, with 21 gate-defining files stale. CI grades the merge of head into base on every push, so the merged tree IS being judged — but no local union run on this branch has judged it, and this body does not claim otherwise.

N1 — the two false statements this body carried, both corrected. (i) “patch for the three repaired consumers” — the entries have read minor since 951369f510; the Changeset-level section now says so and names F1 as the reason. (ii) the 111-family run was quoted beside a test table stamped c5935b2445 — the union is now derived AND re-run in full on the current head 10d7a9f1d9, every measurement block above names the head it was taken on, and @objectstack/spec is genuinely re-measured there because this round changed one of its test files.

验收备注

Findings met on the way, recorded here rather than fixed in this PR:

1. ScopedContext.object(name) returns the CLASS, so the ruled narrowing does not reach ctx.api. Detailed above. A one-line annotation change plus its own consumer census. ⇒ filed as [finding] Ruling A on #16231 narrows IScopedObjectRepository, but ctx.api.object(name) resolves through the CLASS ObjectRepository — the hook-facing door keeps Promise<any>, and updateById keeps it too #16786, which carries item 2 below with it.
2. IScopedObjectRepository.updateById (scoped-context.ts:167) stays Promise[any] while its update sibling narrows. Not named by the ruling. ⇒ same card, [finding] Ruling A on #16231 narrows IScopedObjectRepository, but ctx.api.object(name) resolves through the CLASS ObjectRepository — the hook-facing door keeps Promise<any>, and updateById keeps it too #16786.
3. @objectstack/metadata-protocol declares record / data non-null on its row receipts, while engine.update's by-id exit can answer null — updateData's own comment states the mechanism ("the post-write readback … is also null when the row still exists but the write moved it out of the caller's row scope"). While the door said any this was invisible. This PR preserves the behaviour exactly and writes the disagreement down at byIdUpdateRecord rather than widening a shipped response shape as a rider.
4. check-adr-0087-registration's type-surface-only category cannot be claimed by the class it was built for when the narrowed declaration lives in packages/spec/src/contracts/**. Predicate 2 is no-spec-diff, and a spec-owned contract narrowing is the most likely shape of a published type-surface narrowing in this repo. The category's own header says the alternative an author reaches for is dropping the **BREAKING** token, which [finding] check-adr-0087-registration has no honest disposition for a published TYPE-surface narrowing — every category is refused, so the class is pushed to drop the **BREAKING** token instead #13080 exists to prevent. ⇒ filed as [finding] check-adr-0087-registration's type-surface-only category is unclaimable by the class it was built for: TWO predicates refuse it whenever the narrowed declaration lives in packages/spec/src/contracts/** #16787.
5. core-boundary.ratchet.test.ts flags a forbidden package name in any QUOTED string in core.ts's closure, import or not. Prose in a developerMessage naming the metadata protocol package reddened it. Correct-by-construction for the ratchet's purpose, surprising to hit from a message string; worked around in-file with a comment naming why.

⛔ #15267 does not ride along. It is the driver-layer twin (driver-sql / driver-turso publishing Promise[any] on five IDataDriver doors). Neither card contains the other, and ⛔ neither closes as a duplicate of the other.

Draft only. ⛔ Never ready, never auto-merge, never queue — the in-seat contract-tier review runs before anything lands, and needs:contract-review is hung on this PR.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 5 package(s): @objectstack/metadata-protocol, @objectstack/metadata, @objectstack/objectql, @objectstack/plugin-auth, @objectstack/spec, touching 35 documentable anchor(s). ⚠️ 2 changed file(s) yielded no anchor (packages/objectql/src/find-hook-result-shape.ts, packages/objectql/src/index.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

37 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json 5aef6db0f3c94a4789233b101825bd7da34c1f93.

⛔ 4 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

• 2 changed file(s) yielded no anchor (packages/objectql/src/find-hook-result-shape.ts, packages/objectql/src/index.ts) — pages documenting those are invisible to this run
• 1 cross-cutting symbol(s) contributed no route anchor: updateData (4 routes)
• 1 anchor(s) matched too much of the corpus to be a work list: ObjectQL (symbol, 66 pages)
• 4 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 60 of 216 client-bound route-ledger rows — the other 156 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 156: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 100 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 137 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 5aef6db0f3c94a4789233b101825bd7da34c1f93 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 9ddf53fb5bc32abfab1699af2251573e7574d86c — the merge of head 951369f510cd5231c93f6a18ede676fce016532f into base 5aef6db0f3c94a4789233b101825bd7da34c1f93, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 9ddf53fb5bc32abfab1699af2251573e7574d86c && git checkout 9ddf53fb5bc32abfab1699af2251573e7574d86c
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 5aef6db0f3c94a4789233b101825bd7da34c1f93 951369f510cd5231c93f6a18ede676fce016532f && git checkout -B drift-repro 5aef6db0f3c94a4789233b101825bd7da34c1f93 && git merge --no-ff 951369f510cd5231c93f6a18ede676fce016532f

node scripts/docs-audit/affected-docs.mjs --json 5aef6db0f3c94a4789233b101825bd7da34c1f93

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 5aef6db0f3c94a4789233b101825bd7da34c1f93 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-zhuang]

Contract review (CONTRACT_REVIEW_TIER, isolated seat) — PR #16783 @ c5935b2

Verdict: CHANGES REQUIRED — one required gate is red on the head (Check Changeset, level axis), which makes the PR unmergeable regardless of the review; the contract work itself is sound and would be PASS WITH FINDINGS once F1 is fixed.

Ruling implemented: exactly — three declarations (data-engine.ts findOne/update/delete, scoped-context.ts:148/164, ObjectQL itself), three seam guards mirroring find()'s, pins per verb, the census posted on the card before any declaration moved (comment 5578614790), consumer repairs the census names, changeset minor on @objectstack/spec + @objectstack/objectql with the **BREAKING** banner and an ADR-0087 disposition, #15267 not ridden along. Wider only by the three exported predicates/error classes on @objectstack/objectql's index, which is the #15823 precedent's own pattern. Two surfaces outside the ruling's anchors (ObjectRepository/ctx.api, updateById) are reported, not absorbed — see F6.

Read independently: PR body, its one bot comment, card #16231 body + all 8 comments; code via git fetch of the head into a throwaway ref against origin/main (merge-base 8ccf7a1d); CI via check runs and the failing job's log. Nothing in the PR body was taken on trust.

1. The ruling, verbatim, and its provenance

Card #16231, comment 5572153316 (hotlong, MEMBER, director seat), 2026-09-07:

Ruling recorded — A: findOne / update / delete declare what they answer, and the hook seam is guarded the way find() is — after the breakage is measured first (director seat, summon #17, decision batch #2, 2026-09-07)

Provenance (who / verbatim / where): maintainer, live PM chat with the director seat (session_01XesLUWmuhjuRwmU618AZ1M), 2026-09-07T14:4xZ, batch #2 presented as 1B · 2A · 3(1) · 4A · 5(2) with this card as item 4 recommending A with a measure-first premise (the 5571647365 four-facet block); reply, verbatim: 「同意」.

Ruled. The find() rule from #15823 extends to the other three verbs: ObjectQL.findOne declares a record-or-null result, update and delete declare their result shapes (packages/spec/src/contracts/data-engine.ts:276-279 and the scoped-context mirrors at scoped-context.ts:148/164, read on origin/main), and each hook seam guards hookContext.result against its declaration exactly as find() now does. Options B (declare only) and C (record any as intended) are refused.

Premise the dev verifies before any declaration moves (the confidence gap the maintainer accepted): count the consumers, in-repo and in the consuming repos this session can reach, whose compilation the narrowing breaks; post the number on this card. A large number is a fork to report with the list, ⛔ not a reason to fall back to B silently — the ruling stands, the sequencing is the seat's.

Execution, domain:engine lane: one PR — three declarations, three seam guards, pins per verb, consumer repairs the census names, changeset minor for @objectstack/spec (and the engine package) with the BREAKING banner + ADR-0087 disposition (a published .d.ts narrows). Clause-②: yes ⇒ dispatch at CONTRACT_REVIEW_TIER or with the carrier as compensation. #15267 (the driver-layer twin) does not ride along.

This is a maintainer ruling (verbatim 「同意」 to a batch whose item 4 recommended A), recorded by the director seat with provenance — not a seat or triage preference. Triage (5571647365, os-zhuang) recommended A but explicitly did not rule. The "WHICH LEVEL" text the changeset cites is likewise a maintainer ruling (batch #35, on #15294) recorded verbatim in .github/workflows/pr-automation.yml:667-682. The PR body's citations are accurate.

2. Files vs merge-base, governed paths

31 files (A 3, M 28), 8 commits on the branch. Governed paths (docs/adr/**, .claude/**, skills/**, AGENTS.md, CLAUDE.md, content/docs/releases/**): none touched. The two content/docs/references/api/*.mdx edits are the AUTO-GEN surface (AGENTS.md:677), regenerated by gen:schema && gen:docs; the drift bot's "4 release-owned pages affected" is about pages that name touched symbols, not pages this diff edits.

3. The contract change

verb	origin/main	head	driver exit(s) actually reached
IDataEngine.findOne / ObjectQL.findOne / IScopedObjectRepository.findOne	Promise<any>	Promise<Record<string, any> | null>	driver.findOne → Record<string, unknown> | null
IDataEngine.update / ObjectQL.update / IScopedObjectRepository.update	Promise<any>	Promise<Record<string, any> | number | null>	by-id driver.update → record-or-null; predicate driver.updateMany → count (only two result = assignments exist inside update(), engine.ts:11839 and :12047)
IDataEngine.delete / ObjectQL.delete	Promise<any>	Promise<boolean | number>	by-id driver.delete → boolean; predicate driver.deleteMany → count

No throw arm was added to the declarations; the guards add one runtime arm each. "Hook seams are guarded" in code: verb-hook-result-shape.ts exports three typeof/Array.isArray container predicates (isFindOneResultShape, isUpdateResultShape, isDeleteResultShape — identity-free, so in-place mutation and reassignment to a legal shape stay legal; false/0/null are admitted where declared; undefined refused everywhere), and engine.ts calls each immediately after the after* dispatch and before maskSecretFields/stripSearchCompanion*/realtime publish (:9819, :12105, :13585), throwing an error class with code+status (500) — the same placement and envelope as #15823's find() guard.

Consumers (in-repo, non-test, head): packages/metadata/src/loaders/database-loader.ts (3 sites), packages/metadata-protocol/src/protocol.ts (4 by-id engine.update sites + updateData), packages/plugins/plugin-auth/src/objectql-adapter.ts (2), packages/runtime/src/sandbox/body-runner.ts (2), packages/objectql/src/lifecycle/lifecycle-service.ts (2), packages/objectql/src/validation/rule-validator.ts, packages/core/src/utils/{bulk-write,metadata-activation-store}.ts, packages/platform-objects/src/system/migration-flag.ts, packages/metadata-protocol/src/migrations/recorded-by-sentinel.ts, spec migration entries (prose examples), examples/app-showcase (3 ql.update calls, result discarded), examples/app-todo (its own engine shape on the action ctx, not IDataEngine). apps/* and examples/* are workspace members (pnpm-workspace.yaml) and were inside the turbo run typecheck census. Compiled types move only where a result is read without a null check or where the number limb reaches a record slot — the three non-test files the census names, plus 15 test files; I found no fourth. Runtime behaviour on the published doors: yes (Clause-②) — three new 500 refusal paths at the seams. Against every in-repo driver (memory results[0] || null, sql results[0] || null / formatOutput(...) || null / count > 0, mongodb ?? null / deletedCount > 0, turso ?? null / rowsAffected > 0) every exit is on-contract, so no in-repo caller's runtime output changes; the only measured runtime effects were the seven off-contract test doubles the PR repairs. The consumer repairs are no-ops on reachable paths (number limb unreachable from by-id calls) — verified against resolveEngineUpdateDispatch's use at :11252.

4. Changeset

.changeset/engine-verb-result-declarations.md: @objectstack/spec: minor, @objectstack/objectql: minor, @objectstack/metadata: patch, @objectstack/metadata-protocol: patch, @objectstack/plugin-auth: patch. **BREAKING** banner present; <!-- adr-0087: not-required (no-migration-prescription) … --> parses — check-adr-0087-registration on the head logs [BREAKING+bang] not-required (no-migration-prescription); the ! commit owes both and both are present. major correctly refused/absent. But the level axis is red — see F1. Type FROM/TO per door is stated; runtime FROM/TO is stated once for all three doors — see F3.

5. Tests

packages/objectql/src/engine-verb-hook-result-shape.test.ts: 29 cases (9/9/9 per verb + 2 vocabulary), counted independently; 15 refusal cases assert instanceof + code + status + event + object + observed via an outcomeOf capture (no bare toThrow()), 14 answerability/shaping cases exercise the real engine over an on-contract driver. Refusal cases redden if any guard is removed (consistent with the PR's 15/14 ablation; the 14 greens are held by the engine/driver, correctly). The { deleted: 1 } envelope has its own pin; the sanitizeRowError SQL-verb constraint is pinned. ErrorCode.safeParse control rejects a near-miss spelling. No it.skip/.only/.todo/xit in any changed test file (scanned all 17). Typecheck coverage: tsconfig.test.json includes src/**/*, typecheck chains check:test-typecheck; CI Type Check · workspace / debt ledger green. The seven double repairs (data-engine.test.ts, engine.test.ts, plugin.integration.test.ts, engine-filter-tokens.test.ts, seed-loader.test.ts) are as described. Gap: the declarations themselves have no pin — see F2.

6. ADR-0112 / vocabulary ledger

FIND_ONE_HOOK_RESULT_NOT_RECORD, UPDATE_HOOK_RESULT_NOT_WRITE_SHAPE, DELETE_HOOK_RESULT_NOT_WRITE_SHAPE are registered in ERROR_CODE_LEDGER (error-code-ledger.zod.ts) with owner/meaning comments, carry readonly status = 500 (what check:error-status-conformance derives from), and the generated contract.mdx / error-code-ledger.mdx are regenerated (+3). The registration footprint is byte-for-byte the precedent's: the six non-test files naming FIND_HOOK_RESULT_NOT_ARRAY on main are exactly the six naming the new codes on the head. ADR-0130 in this repo is the release-artifact co-ownership boundary and has no interplay with these codes; the runtime vocabulary these must be in is ADR-0112 D3/D4's ledger, and they are.

7. CI on head c5935b2445

38 check runs: failure 2 (Check Changeset, both workflow runs — same cause, F1), success 30, skipped 6 (Auto Label/Check PR Size duplicates, Packed-tarball smoke (opt-in) ×2, Console Pin Gate), in_progress 0. mergeable_state: unstable. Head is 17 commits behind origin/main (dd2184ae), merge-base 8ccf7a1d.

Findings

F1 — BLOCKING. Check Changeset is red on the level axis. Log, verbatim: ⛔ This PR declares clause-② YES and grades a package it grew patch. naming @objectstack/metadata: patch and @objectstack/metadata-protocol: patch. @objectstack/plugin-auth: patch is the same case and escapes only through the gate's packages/*/src/** blind spot the PR body itself cites (#16713). The PR body's "111 derived, 111 run, all exit 0" is not a reading of this axis: run locally, check-changeset-no-major has no $GITHUB_EVENT_PATH, reads no declaration, and reports NOT MEASURED with exit 0. Expectation: raise the three consumer entries to minor (the fixed group versions in lockstep, so the published version outcome is identical) — or, if the seat rules the declaration wrong for consumer repairs, have that ruled rather than tolerated in the gate; and correct the body's gate claim to say the level axis was NOT MEASURED locally.

F2 — The three declarations have no pin; only the guards do. Reverting findOne/update/delete to Promise<any> while keeping the guards reddens nothing: every census repair (if (!row), typeof x === 'number' ? … : …, result!.assignee) and the one new typed helper (writtenRow(result: Record<string, any> | number | null)) compiles identically against any. Ruling A's declaration half is therefore unenforced (ADR-0049). Expectation: a type-level pin under check:test-typecheck in packages/spec/src/contracts/data-engine.test.ts — e.g. // @ts-expect-error on an un-null-checked property read of findOne's result and on delete's result used as a record, and a number-limb narrowing that fails to compile if update widens back to any.

F3 — Changeset runtime FROM/TO is aggregated, not per door. The type FROM/TO is per verb, but the runtime change ("a host that installs after* handlers … now receives a refusal") is one sentence for three doors, and omits the second source the PR's own developerMessage names: an off-contract driver answer now trips the refusal too. Expectation: three FROM/TO lines (per door: FROM whatever the dispatch left, returned silently → TO 500 <CODE>), each naming both sources.

F4 — byIdUpdateRecord (metadata-protocol/src/protocol.ts) throws a bare Error with no ADR-0112 code on the number limb. Unreachable by construction today, so acceptable as an invariant assertion; note that if it ever fires at an HTTP door it demotes to a generic 500 with no branchable code.

F5 — Observation, no change owed. The update guard checks the batch hookContext after the per-row afterUpdate fan-out; per-row contexts are separate objects (buildPerRowAfterContexts), so a per-row handler's ctx.result reassignment never reaches the seam. That matches the ruling (the batch context is what the call returns) but the engine.ts:12117 comment "a per-row handler can reassign it" overstates it, and no pin covers the per-row path.

F6 — Reported gap is real; needs a card number before landing. ScopedContext.object(name): ObjectRepository (engine.ts:14728) returns the class, whose five verbs still declare Promise<any> (:14571–:14612), so the hook author's door ctx.api.object(x).findOne() is not narrowed. The PR reports it and the PM seat said it will file; no card is referenced yet on the PR or #16231. Expectation: the follow-up card numbers (this and the type-surface-only gate defect) appear on the PR before it leaves draft.

F7 — 17 commits behind main; mergeable_state: unstable. Bring the branch up to date after F1 so the gate re-reads on a current merge-base.

Seat boundaries: no approval/review action, no label, title, body or branch change, no merge, no file edited; throwaway review refs deleted.

---

Generated by Claude Code

[os-zhuang]

Contract review (claude-fable-5-1, isolated seat) — PR #16783 @ 951369f51

Verdict: PASS-conditional. The ruling on #16231 (option A, comment 5572153316; census precondition discharged at 5578614790) is implemented exactly and every gate on the head is green, so the contract work passes. Three conditions are owed before this PR leaves draft: N1 (the PR body — the merge-commit message — now contradicts the committed changeset and asserts a verification that was not measured), F2 (the declarations still have no compile-time pin) and F6's citation half. F3/F7 are record.

What moved since c5935b2: exactly one commit, 951369f51, git diff c5935b2 951369f51 --stat = .changeset/engine-verb-result-declarations.md | 6 +++--- — the three consumer entries patch → minor. No source, test, config or doc byte moved, so every finding of the first review other than F1 re-measures on identical code and is carried forward on evidence, not assumption. Read via git fetch into a throwaway ref against origin/main (merge-base 8ccf7a1d); the ref is deleted.

Governed-surface check: docs/adr/**, .claude/**, skills/**, AGENTS.md, CLAUDE.md, content/docs/releases/** — none touched (git diff origin/main...HEAD --name-only grep over those prefixes is empty). The two content/docs/references/api/*.mdx edits are the auto-generated surface (gen:schema && gen:docs): contract.mdx +308 more → +311 more, error-code-ledger.mdx +3 rows, and the three rows are exactly the three ledger codes. Governed Surface Queue Guard green. File surface is the 31 files of the first review: 3 census src repairs + 15 census test files + 2 guard-found double files (engine-filter-tokens.test.ts, plugin.integration.test.ts; 15 + 2 = the 17 modified test files, reconciled) + new pin file + verb-hook-result-shape.ts + find-hook-result-shape.ts docblock + engine.ts + index.ts + ledger + data-engine.ts + scoped-context.ts + changeset + 2 generated mdx. Nothing outside the census-repair set.

Ruling re-verified by symbol on 951369f51

surface	declared	evidence
IDataEngine.findOne / update / delete	Promise<Record<string, any> | null> / Promise<Record<string, any> | number | null> / Promise<boolean | number>	packages/spec/src/contracts/data-engine.ts:276, :278, :279
IScopedObjectRepository.findOne / update	same two	packages/spec/src/contracts/scoped-context.ts:149, :165 (the ruling's :148/164 shifted by one line of docblock)
ObjectQL.findOne / update / delete	same three	packages/objectql/src/engine.ts:9713, :10900, :13140
seam guards	isFindOneResultShape / isUpdateResultShape / isDeleteResultShape immediately after the after* dispatch, before maskSecretFields / stripSearchCompanion* / realtime publish, ahead of return hookContext.result at :9847 / :12188 / :13638	engine.ts:9832, :12119, :13592
error classes / codes	FindOneHookResultNotRecordError → FIND_ONE_HOOK_RESULT_NOT_RECORD, UpdateHookResultNotWriteShapeError → UPDATE_HOOK_RESULT_NOT_WRITE_SHAPE, DeleteHookResultNotWriteShapeError → DELETE_HOOK_RESULT_NOT_WRITE_SHAPE, all readonly status = 500	verb-hook-result-shape.ts:134-157, :193-220, :261-285; exported from packages/objectql/src/index.ts:209-222
ledger (#16404)	three rows with owner/meaning comments	packages/spec/src/api/error-code-ledger.zod.ts +FIND_ONE_HOOK_RESULT_NOT_RECORD, +DELETE_HOOK_RESULT_NOT_WRITE_SHAPE, +UPDATE_HOOK_RESULT_NOT_WRITE_SHAPE

check:dispatcher-error-vocabulary: runs in Lint & Repo Gates (.github/workflows/lint.yml:2610), green on the head. The runtime declaration table (packages/runtime/src/dispatcher-error-vocabulary.ts) carries neither the new codes nor the sibling FIND_HOOK_RESULT_NOT_ARRAY — consistent: a ledger row removes the site from the scan ("as any registration does", script header), so there is no stale pending-registration row to leave behind.

Refusal wording: all three developerMessages name the seam and both sources — verbatim, findOne: "TWO things can put another shape here: a '${event}' handler that assigned one, or a driver whose 'findOne' answered off its own contract" (verb-hook-result-shape.ts:173-184); update names 'update' / 'updateMany' (:238-250); delete names 'delete' / 'deleteMany' (:303-315). The shared user-facing sentence composer states the reason in its own docblock (:336+). Correct for the reason the PR gives: four of the seven repaired doubles were driver exits, not handlers.

Census spot-checks (2 of 4 doubles): packages/spec/src/contracts/data-engine.test.ts — five delete doubles { deleted: 1 } / ({}) → 1 / true; packages/runtime/src/seed-loader.test.ts:73-79 — { deleted: 1 } → 1. The { deleted: 1 } envelope has its own refusal pin at engine-verb-hook-result-shape.test.ts:385-392 and sits in the refusal table at :362. The new test file has 22 it( cases, no .skip / .only / .todo.

Changeset (.changeset/engine-verb-result-declarations.md @ head): @objectstack/spec: minor, @objectstack/objectql: minor, @objectstack/metadata: minor, @objectstack/metadata-protocol: minor, @objectstack/plugin-auth: minor; **BREAKING** banner; <!-- adr-0087: not-required (no-migration-prescription) … -->. Check Changeset log on the head, verbatim: ✓ check-adr-0087-registration: 1 declared-breaking changeset(s) … [BREAKING+bang] not-required (no-migration-prescription); ✓ This diff introduces no major bump.; ✓ LEVEL AXIS: this PR declares clause-② yes, and no package whose packages/*/src/** it moves is graded patch. with carrier: needs:contract-review IS on this PR. As the dev's report states, that green does not grade plugin-auth (nested dir, #16713) — it is minor because the rule says so. Fixes #16231 is a closing keyword, and Part-of PR must not also close its card is green (there is no Part-of: line).

CI on 951369f51: 38 check runs — 32 success, 6 skipped (Auto Label / Check PR Size duplicates, Packed-tarball smoke (opt-in) ×2, Console Pin Gate), 0 failure, 0 in_progress. mergeable_state: clean. Branch is 69 commits behind origin/main (was 17 at c5935b2), merge-base unchanged at 8ccf7a1d.

First review's findings (comment 5580313505), re-measured on 951369f51

#	first-review finding	status @ 951369f51	evidence
F1	Check Changeset red on the level axis (three consumers patch under Clause-②: yes); correct the body's "111 run, all exit 0" claim	half discharged	level axis: all three entries minor, both Check Changeset runs success, ✓ LEVEL AXIS printed. Body correction: still open — the body is byte-identical to the one reviewed at c5935b2 (PR updated_at moved only for the label re-hang); see N1
F2	declarations have no compile-time pin; reverting to Promise<any> reddens nothing	still open	no @ts-expect-error / expectTypeOf / assertType added anywhere in the diff (grep of origin/main...HEAD is empty); data-engine.test.ts changes are double repairs only
F3	changeset runtime FROM/TO aggregated, not per door; omits the driver source	still open	changeset prose unchanged apart from the three level words; the runtime sentence is still the single "A host that installs after* handlers … now receives a refusal"
F4	byIdUpdateRecord throws a bare Error with no ADR-0112 code	still open (record)	packages/metadata-protocol/src/protocol.ts:896-905, unchanged
F5	engine.ts comment "a per-row handler can reassign it" overstates; no per-row pin	still open (observation)	engine.ts:12116-12117, unchanged
F6	follow-up cards not numbered on the PR	superseded in substance, citation still open	both cards exist and predate the first review: #16786 (ctx.api.object() resolves through the class; updateById too), #16787 (type-surface-only unclaimable when the narrowed declaration lives in packages/spec/src/contracts/**), both 2026-09-08T05:22-23Z. Neither is cited in the PR body, on the PR, or in the card's patch-round comments (5582311948…5585637091 cite #16713/#16796/#16810/#16840 only)
F7	17 behind main, mergeable_state: unstable	still open, worse	69 behind origin/main; mergeable_state is now clean (no conflict, all required checks green), so this is hygiene rather than a merge blocker

New findings

1. N1 — blocking (before undraft). The PR body, which becomes the merge-commit message, now contradicts the head on two counts. (a) Its Changeset section still reads "minor for @objectstack/spec and @objectstack/objectql, patch for the three repaired consumers" while .changeset/engine-verb-result-declarations.md @ 951369f51 grades all five minor. (b) It still asserts "111 derived, 111 run … all 111 exiting 0" as covering the head, when the level axis was NOT MEASURED locally (no $GITHUB_EVENT_PATH) and was in fact red at c5935b2; and the test/typecheck table is stamped c5935b2445. The dev's own report (5585604597) records this half of F1 as "still owed" — it was carved out of the changeset-only round twice. Expectation: correct (a) with the reasoning the dev already posted (fixed version group, so the release effect is nil; the green does not grade plugin-auth); correct (b) by stating what was measured, not by deleting the sentence; add the follow-up card numbers (F6) in the same edit. No code change.

2. N2 — record. core-boundary.ratchet.test.ts — this is a legitimate in-file avoidance, not a ratchet workaround. The ratchet (packages/objectql/src/core-boundary.ratchet.test.ts:59, :94-97) is unchanged on this branch and tests new RegExp(`['"]${pkg}['"]`) over the raw text of every file in core.ts's closure — a QUOTED package specifier anywhere, import or not. verb-hook-result-shape.ts is in that closure (imported by engine.ts:96-103), adds no import, and simply spells "the metadata protocol layer" without the quoted specifier (:306-309, comment naming the ratchet and ADR-0076 D2). No exemption list was touched, no allowance added. The ledger comment on the same code (error-code-ledger.zod.ts, DELETE_… row) uses backticks, which the regex does not match. Nothing owed; recorded so nobody reads the comment as evidence of a suppressed ratchet.

3. N3 — record. The class-vs-interface hole is real and is correctly filed, not owed here. export class ObjectRepository implements IScopedObjectRepository (engine.ts:14557) keeps findOne / update / delete at Promise<any> (:14571, :14589, :14604) and ScopedContext.object(name): ObjectRepository (:14728) returns the class, so ctx.api.object('x').findOne() reads any after this PR. Runtime is not a hole: the class delegates to this.engine.findOne / update / delete, so the three seam guards fire on that path too — only the compile-time narrowing fails to reach it. The ruling names data-engine.ts:276-279 and scoped-context.ts:148/164, not the class, and it required a census before any declaration moved; narrowing the class needs its own (ctx.api consumers across hooks/flows/plugins). Judgement: outside ruling scope, correctly filed as [finding] Ruling A on #16231 narrows IScopedObjectRepository, but ctx.api.object(name) resolves through the CLASS ObjectRepository — the hook-facing door keeps Promise<any>, and updateById keeps it too #16786; the same card carries updateById (scoped-context.ts:168, still Promise<any>). The metadata-protocol non-null receipts disagreement is stated at protocol.ts:888-895 and behaviour is preserved (null passes through unchanged) — stated, not silently changed.

4. N4 — observation. isFindOneResultShape / isUpdateResultShape / isDeleteResultShape are declared (value: unknown): boolean rather than type predicates (value is Record<string, any> | null etc.). Functionally identical at the seam because hookContext.result is any; but they are exported "so a host can check its own answer before the engine does", and a type predicate would let that host narrow. Not owed by the ruling; a one-line improvement for a follow-up.

Maintainer-only merge: yes. feat! narrowing three published .d.ts doors with Clause-②: yes and the **BREAKING** banner under the launch-window minor convention; the level for plugin-auth is not gate-measurable (#16713); the merge-commit message (PR body) is currently false on the changeset level and on verification (N1); F2 leaves the declaration half of ruling A unenforced against reversion. The PR's own text says never auto-merge, never queue; this seat agrees.

Seat boundaries: no approval/review action, no label, title, body or branch change, no merge, no file edited; refs/review/16783 deleted and confirmed absent via git show-ref.

---

Generated by Claude Code