chore(plugin-audit,metadata-protocol): gate hygiene for the content-hash family (#21207)

Record the new pinned engine doubles in the engine-double ledger, read the
decision-audit code column through an operator-form predicate (a read, not a
stamp), and mark the persisted audit vocabulary in the new pins.

Claude-Session: https://claude.ai/code/session_01VvcEokUG1tvVxkceYfR5XB
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/metadata-protocol/src/protocol.served-content-hash.test.ts

@@ -299,7 +299,7 @@ describe('[#21207] inbound version tokens are compared in keyed form', () => {
         await p.saveMetaItem({ ...ref, item: viewBody('v2'), parentVersion: v1.version } as any);
         await rejection(() => p.saveMetaItem({ ...ref, item: viewBody('lost'), parentVersion: v1.version } as any));
 
-        const denials = h.auditRows.filter((a) => a.code === 'metadata_conflict');
+        const denials = h.auditRows.filter((a) => a.code === 'metadata_conflict'); // adr0112-ok: D6b persisted audit column
         expect(denials).toHaveLength(1);
         const note = String(denials[0]!.note);
         expect(note).not.toMatch(SHA256);

packages/plugins/plugin-audit/src/audit-writers.test.ts

@@ -2371,7 +2371,9 @@ describe('[#21207] stored metadata copies carry no content hash', () => {
     await fire('afterUpdate', {
       object: 'sys_metadata_audit',
       input: { id: 'd-1', data: { note: 'expected parent (withheld) but current is (withheld)' } },
+      // adr0112-ok: D6b persisted audit column
       previous: { id: 'd-1', code: 'metadata_conflict', note: `expected parent ${PARENT} but current is ${HASH}` },
+      // adr0112-ok: D6b persisted audit column
       result: { id: 'd-1', code: 'metadata_conflict', note: 'expected parent (withheld) but current is (withheld)' },
       session: {},
     });

packages/plugins/plugin-audit/src/stored-metadata-body-migration.ts

@@ -100,6 +100,7 @@ export function withheldStoredHashTokens(text: string): string {
 export const METADATA_DECISION_AUDIT_OBJECT = 'sys_metadata_audit';
 
 /** The persisted code of an optimistic-concurrency refusal's decision-audit row. */
+// adr0112-ok: D6b — the persisted audit column's own vocabulary, not a wire code
 const CONFLICT_NOTE_CODE = 'metadata_conflict';
 
 /** The conflict note's one sentence, as every writer of it has spelled it. */
@@ -404,7 +405,10 @@ export async function migrateStoredMetadataBodyCopies(
   const copiedObjects = [...STORED_METADATA_BODY_OBJECTS, METADATA_DECISION_AUDIT_OBJECT];
   const tables: ReadonlyArray<{ object: string; where: Record<string, unknown> }> = [
     ...STORED_METADATA_BODY_AUDIT_OBJECTS.map((object) => ({ object, where: { object_name: { $in: copiedObjects } } })),
-    { object: METADATA_DECISION_AUDIT_OBJECT, where: { code: CONFLICT_NOTE_CODE } },
+    // A PREDICATE on the persisted `code` column (ADR-0112 D6b, the audit
+    // column's own vocabulary), written in operator form: it reads rows by the
+    // code they carry and stamps none.
+    { object: METADATA_DECISION_AUDIT_OBJECT, where: { code: { $eq: CONFLICT_NOTE_CODE } } },
   ];
   for (const { object, where } of tables) {
     report.byObject[object] = { scanned: 0, rewritten: 0 };

packages/plugins/plugin-audit/src/stored-metadata-hash-migration.test.ts

@@ -35,6 +35,8 @@ const metaSnapshot = () => ({ id: 'm1', name: 'v', type: 'view', scope: 'platfor
 const historySnapshot = () => ({ id: 'h1', name: 'v', type: 'view', metadata: view('one'), checksum: HASH, previous_checksum: PARENT });
 const conflictNote = `expected parent ${PARENT} but current is ${HASH}`;
 const WITHHELD_NOTE = 'expected parent (withheld) but current is (withheld)';
+/** The decision-audit `code` column's own vocabulary (ADR-0112 D6b), not an error code. */
+const CONFLICT_CODE = 'metadata_conflict'; // adr0112-ok: D6b persisted audit column
 
 describe('planAuditRowPatch / planActivityRowPatch — the hash columns leave the copy', () => {
   it('a sys_metadata create snapshot loses its checksum, and nothing else', () => {
@@ -83,22 +85,22 @@ describe('planAuditRowPatch / planActivityRowPatch — the hash columns leave th
 
 describe('planDecisionNotePatch — the decision-audit note and its copies', () => {
   it('withholds both hashes of a conflict note', () => {
-    const patch = planDecisionNotePatch('sys_metadata_audit', { id: 'd1', code: 'metadata_conflict', note: conflictNote });
+    const patch = planDecisionNotePatch('sys_metadata_audit', { id: 'd1', code: CONFLICT_CODE, note: conflictNote });
     expect(patch).toEqual({ note: WITHHELD_NOTE });
   });
 
   it('keeps a null side as null', () => {
-    const patch = planDecisionNotePatch('sys_metadata_audit', { id: 'd2', code: 'metadata_conflict', note: `expected parent null but current is ${HASH}` });
+    const patch = planDecisionNotePatch('sys_metadata_audit', { id: 'd2', code: CONFLICT_CODE, note: `expected parent null but current is ${HASH}` });
     expect(patch).toEqual({ note: 'expected parent null but current is (withheld)' });
   });
 
   it('leaves every other note alone, and is idempotent', () => {
     expect(planDecisionNotePatch('sys_metadata_audit', { id: 'd3', code: 'ok', note: 'restored from version 2' })).toBeNull();
-    expect(planDecisionNotePatch('sys_metadata_audit', { id: 'd4', code: 'metadata_conflict', note: WITHHELD_NOTE })).toBeNull();
+    expect(planDecisionNotePatch('sys_metadata_audit', { id: 'd4', code: CONFLICT_CODE, note: WITHHELD_NOTE })).toBeNull();
   });
 
   it('rewrites the ledger and activity copies of a conflict note', () => {
-    const snapshot = { id: 'd1', type: 'view', name: 'v', operation: 'save', outcome: 'denied', code: 'metadata_conflict', note: conflictNote };
+    const snapshot = { id: 'd1', type: 'view', name: 'v', operation: 'save', outcome: 'denied', code: CONFLICT_CODE, note: conflictNote };
     const audit = planDecisionNotePatch('sys_audit_log', {
       id: 'a5', object_name: 'sys_metadata_audit', record_id: 'd1', new_value: JSON.stringify(snapshot), old_value: null,
     });
@@ -139,12 +141,12 @@ describe('migrateStoredMetadataBodyCopies — the content-hash copies (driven)',
     sys_metadata: [{ id: 'm1', type: 'view', name: 'v' }],
     sys_audit_log: [
       { id: 'a1', object_name: 'sys_metadata', record_id: 'm1', new_value: JSON.stringify(metaSnapshot()), old_value: null },
-      { id: 'a2', object_name: 'sys_metadata_audit', record_id: 'd1', new_value: JSON.stringify({ id: 'd1', code: 'metadata_conflict', note: conflictNote }), old_value: null },
+      { id: 'a2', object_name: 'sys_metadata_audit', record_id: 'd1', new_value: JSON.stringify({ id: 'd1', code: CONFLICT_CODE, note: conflictNote }), old_value: null },
       { id: 'a3', object_name: 'file_blob', record_id: 'f1', new_value: JSON.stringify({ id: 'f1', checksum: HASH }), old_value: null },
     ],
     sys_activity: [{ id: 'ac1', object_name: 'sys_metadata_history', record_id: 'h1', metadata: JSON.stringify({ old: null, new: historySnapshot() }) }],
     sys_metadata_audit: [
-      { id: 'd1', code: 'metadata_conflict', note: conflictNote },
+      { id: 'd1', code: CONFLICT_CODE, note: conflictNote },
       { id: 'd2', code: 'ok', note: 'active' },
     ],
   });

scripts/engine-double-contract.pinned.json

@@ -486,6 +486,11 @@
       "verb": "update",
       "pinned": 1
     },
+    {
+      "file": "packages/metadata-protocol/src/protocol.data-door-stored-content-hash.test.ts",
+      "verb": "findOne",
+      "pinned": 2
+    },
     {
       "file": "packages/metadata-protocol/src/protocol.data-door-stored-metadata-redaction.test.ts",
       "verb": "findOne",
@@ -1331,6 +1336,21 @@
       "verb": "update",
       "pinned": 1
     },
+    {
+      "file": "packages/metadata-protocol/src/protocol.served-content-hash.test.ts",
+      "verb": "delete",
+      "pinned": 1
+    },
+    {
+      "file": "packages/metadata-protocol/src/protocol.served-content-hash.test.ts",
+      "verb": "findOne",
+      "pinned": 1
+    },
+    {
+      "file": "packages/metadata-protocol/src/protocol.served-content-hash.test.ts",
+      "verb": "update",
+      "pinned": 1
+    },
     {
       "file": "packages/metadata-protocol/src/protocol.stored-conversions.test.ts",
       "verb": "delete",
@@ -2491,6 +2511,16 @@
       "verb": "update",
       "pinned": 1
     },
+    {
+      "file": "packages/plugins/plugin-audit/src/stored-metadata-hash-migration.test.ts",
+      "verb": "findOne",
+      "pinned": 1
+    },
+    {
+      "file": "packages/plugins/plugin-audit/src/stored-metadata-hash-migration.test.ts",
+      "verb": "update",
+      "pinned": 1
+    },
     {
       "file": "packages/plugins/plugin-auth/src/accept-invitation-adopt-membership.test.ts",
       "verb": "delete",