test(where-matcher): empty the combinator-blind ledger — 75 files, refuse unrecognised $-keys (#8618)

* test(where-matcher): batch 1 — refuse unrecognised $-keys (metadata-protocol, objectql, plugin-approvals, plugin-auth)

Part of the #8582 sweep: 39 test-double matches(row, where) fakes across
these four packages treated $or/$and as ordinary field names and silently
dropped rows on any combinator query. Each now throws on an unrecognised
$-prefixed key instead — the recorded practice already pinned in
packages/objectql/src/engine-autonumber-*.test.ts ("silently ignoring an
unknown operator would let a bad query pass as a good one").

Ledger (scripts/where-matcher-conformance.baseline.json) ratcheted down by
the same 39 entries in this commit — pnpm check:where-matcher confirms
0 problems for these files.

Refs #8582

* test(where-matcher): batch 2 — refuse unrecognised $-keys (plugin-email, plugin-hono-server, plugin-reports, plugin-security, plugin-sharing, rest)

Part of the #8582 sweep. 22 more combinator-blind matches(row, where) fakes
now throw on an unrecognised $-prefixed key instead of treating it as a
field name and silently dropping every row a combinator query touches.

Two files needed more than the mechanical guard:

- packages/plugins/plugin-sharing/src/business-unit-graph.test.ts already
  implements $or correctly (a real, exercised recursive conjunction) — added
  a refusal for any OTHER $-key ($and included) rather than growing a second
  combinator implementation nothing in the suite exercises.
- packages/plugins/plugin-email/src/outbox-sweep.test.ts was the ledger's
  one UNJUDGED matcher. Its nested-operator throw message (`fakeEngine:
  unsupported operator ${op}`) coincidentally repeats its enclosing factory
  function's exact name, and the gate's identifiersIn() text-scanner reads
  that string-literal word as if it were a reference to the factory —
  pulling in the whole `fakeEngine(seed)` closure and its unsuppliable
  `seed` parameter, so the standalone extraction always threw
  `ReferenceError: seed is not defined`. Disposition: RESTRUCTURE (rename
  the message so it no longer shadows the enclosing scope) rather than
  extractor-reach — a one-line, zero-blast-radius fix versus changing the
  shared identifiersIn() text-scanner every one of the 168 discovered
  matchers depends on. The matcher now judges CONFORMING.

Ledger ratcheted down by these 22 entries in this commit; 14 remain
(services/*, triggers) for the next batch.

Refs #8582

* test(where-matcher): batch 3 — refuse unrecognised $-keys (service-analytics, service-automation, service-messaging, service-queue, service-settings, service-storage, trigger-schedule)

Part of the #8582 sweep. Final 14 combinator-blind matches(row, where)
fakes now throw on an unrecognised $-prefixed key.

Two files already implement $and genuinely (a real, exercised recursive
conjunction) — service-analytics/src/__tests__/objectql-daterange.test.ts
and objectql-read-scope.test.ts. Both get a refusal for any OTHER $-key
($or included) rather than growing a second combinator implementation
nothing in their suites exercises.

Ledger (scripts/where-matcher-conformance.baseline.json) ratcheted to
empty — its intended steady state (pnpm check:where-matcher reference:
"78 (4 by refusing)" is now zero grandfathered, matching shape (a)'s empty
ledger). pnpm check:where-matcher: 168 matcher(s) discovered, 168
conforming (83 by refusing), 0 silently wrong, 0 unjudged.

Refs #8582

* fix(service-analytics): implement $or in objectql-daterange.test.ts's matcher, not refuse it

Batch 3 (e089b9f) added a blanket $-key refusal to this file's matches()
double, on the (wrong) assumption that $or was dormant here like the rest
of the sweep. It is not: the "keeps both operands when a bare equality
meets an operator object" test drives query() through fieldLeaves' real
NULL-safe $ne expansion (#5298), which emits `$and: [{ $or: [{field:null},
{field:{$ne}}] }]` — the double genuinely receives $or at runtime, and the
new refusal turned a passing test red (`Error: test bridge: unhandled
operator $or`).

Per the issue's own guidance, option 1 (implement) applies where a suite
genuinely exercises the combinator — $and was already handled this way in
this file, $or now gets the same treatment (`.some()` over the branches),
matching the file's existing recursive style. pnpm check:where-matcher
confirms this matcher now CONFORMS by correctly answering the combinator
battery, not by refusing.

Refs #8582

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-zhuang

packages/metadata-protocol/src/protocol.delete-rewrap-envelope.test.ts

@@ -134,6 +134,7 @@ const seedRow = (type: string, name: string): Row => ({
 
 const matchesWhere = (row: Record<string, unknown>, where: Record<string, unknown>) =>
     Object.entries(where ?? {}).every(([k, v]) => {
+        if (k.startsWith('$')) throw new Error(`fake driver: unsupported operator ${k}`);
         if (v === null || v === undefined) return row[k] === null || row[k] === undefined;
         return row[k] === v;
     });

packages/metadata-protocol/src/protocol.duplicate-package-bundle-key.test.ts

@@ -94,6 +94,7 @@ function matches(r: Record<string, any>, where: Record<string, unknown>): boolea
             if (!clauses.some((c) => matches(r, c))) return false;
             continue;
         }
+        if (k.startsWith('$')) throw new Error(`fake driver: unsupported operator ${k}`);
         if ((r[k] ?? null) !== v) return false;
     }
     return true;

packages/metadata-protocol/src/protocol.flow-canonicalizer.test.ts

@@ -58,6 +58,7 @@ const canonicalizeStoredFlow = (_name: string, body: any) => {
 function matches(r: Record<string, any>, where: Record<string, unknown>): boolean {
     for (const [k, v] of Object.entries(where)) {
         if (v === undefined) continue;
+        if (k.startsWith('$')) throw new Error(`fake driver: unsupported operator ${k}`);
         if ((r[k] ?? null) !== v) return false;
     }
     return true;

packages/metadata-protocol/src/protocol.legacy-overlay-delete.test.ts

@@ -152,6 +152,7 @@ const seedRow = (type: string, name: string): Row => ({
 
 const matchesWhere = (row: Record<string, unknown>, where: Record<string, unknown>) =>
     Object.entries(where ?? {}).every(([k, v]) => {
+        if (k.startsWith('$')) throw new Error(`fake driver: unsupported operator ${k}`);
         if (v === null || v === undefined) return row[k] === null || row[k] === undefined;
         return row[k] === v;
     });

packages/metadata-protocol/src/protocol.stored-migration.test.ts

@@ -43,6 +43,7 @@ interface Row {
 function matches(r: Record<string, any>, where: Record<string, unknown>): boolean {
     for (const [k, v] of Object.entries(where)) {
         if (v === undefined) continue;
+        if (k.startsWith('$')) throw new Error(`fake driver: unsupported operator ${k}`);
         if ((r[k] ?? null) !== v) return false;
     }
     return true;

packages/metadata-protocol/src/sys-metadata-repository.draft-drain.test.ts

@@ -80,7 +80,10 @@ function makeFakeEngine() {
   };
 
   const matchesHistory = (h: Row, where: Record<string, unknown>): boolean =>
-    Object.entries(where).every(([k, v]) => v === undefined || h[k] === v);
+    Object.entries(where).every(([k, v]) => {
+      if (k.startsWith('$')) throw new Error(`fake driver: unsupported operator ${k}`);
+      return v === undefined || h[k] === v;
+    });
 
   return {
     rows,

packages/metadata-protocol/src/sys-metadata-repository.history-counters.test.ts

@@ -94,7 +94,10 @@ function makeFakeEngine() {
   };
 
   const matchesHistory = (h: Row, where: Record<string, unknown>): boolean =>
-    Object.entries(where).every(([k, v]) => v === undefined || h[k] === v);
+    Object.entries(where).every(([k, v]) => {
+      if (k.startsWith('$')) throw new Error(`fake driver: unsupported operator ${k}`);
+      return v === undefined || h[k] === v;
+    });
 
   return {
     rows,

packages/metadata-protocol/src/sys-metadata-repository.package-writability.test.ts

@@ -105,7 +105,10 @@ function makeFakeEngine() {
   };
 
   const matchesHistory = (h: Row, where: Record<string, unknown>): boolean =>
-    Object.entries(where).every(([k, v]) => v === undefined || h[k] === v);
+    Object.entries(where).every(([k, v]) => {
+      if (k.startsWith('$')) throw new Error(`fake driver: unsupported operator ${k}`);
+      return v === undefined || h[k] === v;
+    });
 
   return {
     rows,

packages/metadata-protocol/src/sys-metadata-repository.recorded-by.test.ts

@@ -52,7 +52,10 @@ function makeFakeEngine() {
   };
 
   const matchesHistory = (h: Row, where: Record<string, unknown>): boolean =>
-    Object.entries(where).every(([k, v]) => v === undefined || h[k] === v);
+    Object.entries(where).every(([k, v]) => {
+      if (k.startsWith('$')) throw new Error(`fake driver: unsupported operator ${k}`);
+      return v === undefined || h[k] === v;
+    });
 
   return {
     rows,

packages/objectql/src/adr0104-attestation-evidence.test.ts

@@ -50,7 +50,10 @@ function rowsOf(store: Store, object: string): Array<Record<string, unknown>> {
 function makeDriver(store: Store, stats: { created: number; existing: number }): IDataDriver {
   const matches = (row: Record<string, unknown>, where: any): boolean => {
     if (!where || typeof where !== 'object') return true;
-    return Object.entries(where).every(([k, v]) => row[k] === v);
+    return Object.entries(where).every(([k, v]) => {
+      if (k.startsWith('$')) throw new Error(`fake driver: unsupported operator ${k}`);
+      return row[k] === v;
+    });
   };
   return {
     name: 'default',