fix(engine-doubles): close the two defects the recovered findOne sweep left, and alias metadata-core in service-datasource

Supersedes the "NOT REVIEWED" disclaimer on 88784b7: the gate half and the
211-file adoption below it have now been run, ablated and re-measured. Three
things this commit changes, all of them found by running what that commit never
ran.

1. TS2345 in service-messaging. `delivery-headers-at-rest.integration.test.ts`
   passed the fake's `q: unknown` straight into the predicate, whose parameter is
   `EngineFindOneQueryInput | null | undefined`. vitest never type-checks, so the
   suite was green and `tsc --noEmit` was red — the one direction a test-only
   sweep can go wrong invisibly. Cast at the call, matching the sibling
   `assertEngineUpdateDispatch(d as any, q as any)` pin three lines below it.

2. service-datasource's engine double reached `@objectstack/metadata-core`
   through `dist/`. `check:test-source-alias` names the repair and refuses the
   alternative: alias the specifier in the package's own vitest config, never
   widen the shrink-only registry. A pin resolved through a build artifact is
   pinned to whatever was last built rather than to the predicate beside it,
   which is the single failure a contract pin exists to prevent.

3. Import order in that same test file is now load-bearing, and says so.
   Aliasing metadata-core to source pulls its import graph into the package's
   resolution domain, which switches on the clocked-window rule for the whole
   package — and that rule then misreported a file that has paid its
   `@objectstack/spec/kernel` load at module top since #10120. Cause is a
   detector defect filed as #12555: the gate's import regex swallows a bare
   side-effect import whenever an `import … from …` follows it later in the
   file. Not worked around in the gate — the fix there needs its own
   `--self-test` cases — so the statement is placed where the detector reads it
   correctly, with a comment naming the constraint and the card that removes it.

Author: claude

packages/services/service-datasource/src/__tests__/datasource-admin-plugin.test.ts

@@ -8,13 +8,19 @@ import {
   type DatasourceAdminServicePluginOptions,
 } from '../datasource-admin-plugin.js';
 
+import { assertEngineFindOnePredicate } from '@objectstack/metadata-core';
+
 // [#10126] Pay the first transform of these dist-resolved workspace deps at MODULE
 // LOAD. Each is reached below through a dynamic `import()` inside an `it()` body or a
 // hook -- both of which vitest clocks, while collection is clocked against nothing. See
 // `scripts/check-test-source-alias.mjs` (the clocked-window rule) and #10115 / PR #10120,
 // where the same shape cost 30 ejected merge-queue builds in one night.
+//
+// ORDER IS LOAD-BEARING until #12555 lands: check-test-source-alias's import regex
+// swallows a bare side-effect import whenever an `import … from …` follows it later in
+// the file, so this statement must stay BELOW every `from` import or the clocked-window
+// rule reports this file as unpaid while the line it asks for is already here.
 import '@objectstack/spec/kernel';
-import { assertEngineFindOnePredicate } from '@objectstack/metadata-core';
 
 /**
  * Minimal PluginContext + in-memory metadata service. Boots the plugin and

packages/services/service-datasource/vitest.config.ts

@@ -37,6 +37,17 @@ export default defineConfig({
     // matches by PREFIX, so a bare `@objectstack/core` entry would also swallow
     // `@objectstack/core/logger` and resolve it to `core/src/index.ts/logger`
     // (ENOTDIR). Same shape as `service-storage` and `service-knowledge`.
-    alias: [{ find: /^@objectstack\/core$/, replacement: path.resolve(__dirname, '../../core/src/index.ts') }],
+    // `@objectstack/metadata-core` became a VALUE import of this package's TEST
+    // layer when its engine double adopted `assertEngineFindOnePredicate`
+    // (objectstack#12068). Same reasoning as the entry above, and the same
+    // direction of danger: unaliased it would follow the workspace link to
+    // `packages/metadata-core/dist/index.js`, so the double would be pinned to
+    // whatever the last build of that predicate emitted rather than to the
+    // predicate sitting next to it — a green pin over a stale contract, which is
+    // the one failure a contract pin exists to make impossible.
+    alias: [
+      { find: /^@objectstack\/core$/, replacement: path.resolve(__dirname, '../../core/src/index.ts') },
+      { find: /^@objectstack\/metadata-core$/, replacement: path.resolve(__dirname, '../../metadata-core/src/index.ts') },
+    ],
   },
 });

packages/services/service-messaging/src/delivery-headers-at-rest.integration.test.ts

@@ -288,7 +288,7 @@ describe('sys_http_delivery — authored headers vs the data API (#8118)', () =>
         // its authored configuration.
         const noAccessor = {
             find: (o: string, q: unknown) => (eng as any).find(o, q),
-            findOne: (o: string, q: unknown) => { assertEngineFindOnePredicate(o, q); return (eng as any).findOne(o, q); },
+            findOne: (o: string, q: unknown) => { assertEngineFindOnePredicate(o, q as any); return (eng as any).findOne(o, q); },
             insert: (o: string, d: unknown) => (eng as any).insert(o, d),
             update: (o: string, d: unknown, q: unknown) => {
                 // Engine-double contract: this fake's update() must be exactly