fix(devx): resolve engine doubles bound to a local name, and walk one root constant on both scans

packages/metadata-protocol/src/protocol.batch-atomic.test.ts

@@ -14,6 +14,7 @@
 // is already in the database.
 
 import { describe, it, expect, vi } from 'vitest';
+import { assertEngineDeleteDispatch, assertEngineUpdateDispatch } from '@objectstack/metadata-core';
 import { ObjectStackProtocolImplementation } from './protocol.js';
 
 const SCHEMA = {
@@ -42,11 +43,15 @@ function makeTransactionalEngine(opts: { driverCanTransact?: boolean } = {}) {
  return { id: `rec-${insert.mock.calls.length}`, ...data };
  });
  const update = vi.fn(async (_object: string, data: any, options?: any) => {
+ assertEngineUpdateDispatch(data, options);
  if (data?.title === POISON) throw new Error('update exploded');
  return { id: options?.where?.id, ...data };
  });
  const findOne = vi.fn(async (_object: string, options?: any) => ({ id: options?.where?.id }));
- const del = vi.fn(async () => ({ deleted: 1 }));
+ const del = vi.fn(async (_object: string, options?: any) => {
+ assertEngineDeleteDispatch(options);
+ return { deleted: 1 };
+ });
 
  const engine: any = {
  registry: { getObject: () => SCHEMA },

packages/metadata-protocol/src/protocol.batch-not-attempted.test.ts

@@ -40,6 +40,7 @@
  */
 
 import { describe, it, expect, vi } from 'vitest';
+import { assertEngineDeleteDispatch, assertEngineUpdateDispatch } from '@objectstack/metadata-core';
 import { ObjectStackProtocolImplementation } from './protocol.js';
 
 const SCHEMA = {
@@ -85,6 +86,7 @@ function makeStoreEngine() {
  return rec;
  });
  const update = vi.fn(async (_object: string, data: any, options?: any) => {
+ assertEngineUpdateDispatch(data, options);
  const id = options?.where?.id;
  if (data?.title === POISON) throw validationFailure();
  const next = { ...rows.get(id), ...data };
@@ -93,6 +95,7 @@ function makeStoreEngine() {
  });
  // Contract per #4435: `false` is the positive not-found value.
  const del = vi.fn(async (_object: string, options?: any) => {
+ assertEngineDeleteDispatch(options);
  const id = options?.where?.id;
  if (!rows.has(id)) return false;
  rows.delete(id);

packages/metadata-protocol/src/protocol.bulk-record-not-found.test.ts

@@ -32,6 +32,7 @@
  */
 
 import { describe, it, expect, vi } from 'vitest';
+import { assertEngineDeleteDispatch, assertEngineUpdateDispatch } from '@objectstack/metadata-core';
 import { ObjectStackProtocolImplementation } from './protocol.js';
 
 const SCHEMA = {
@@ -68,6 +69,7 @@ function makeStoreEngine() {
  const handle = { id: 'trx-1' };
 
  const update = vi.fn(async (_object: string, data: any, options?: any) => {
+ assertEngineUpdateDispatch(data, options);
  const id = options?.where?.id;
  // The write pipeline, reached for an id that names no row: the hook
  // condition evaluates against a payload-only record and #4775 aborts.
@@ -78,6 +80,7 @@ function makeStoreEngine() {
  });
  // Contract per #4435: `false` is the positive not-found value.
  const del = vi.fn(async (_object: string, options?: any) => {
+ assertEngineDeleteDispatch(options);
  const id = options?.where?.id;
  if (!rows.has(id)) return false;
  rows.delete(id);

packages/metadata-protocol/src/protocol.dropped-fields.bulk.test.ts

@@ -12,6 +12,7 @@
 // response has no per-row slot; the insert strip is schema-uniform).
 
 import { describe, it, expect, vi } from 'vitest';
+import { assertEngineUpdateDispatch } from '@objectstack/metadata-core';
 import { ObjectStackProtocolImplementation } from './protocol.js';
 
 const SCHEMA = {
@@ -25,6 +26,7 @@ const SCHEMA = {
 describe('updateManyData — per-row droppedFields + context threading (#3455)', () => {
  it('surfaces per-row engine strips and threads the caller context to each update', async () => {
  const update = vi.fn(async (object: string, data: any, options?: any) => {
+ assertEngineUpdateDispatch(data, options);
  // Only the second row forges the readonly field → only it drops.
  if (data.approval_status !== undefined) {
  options?.onFieldsDropped?.({ object, fields: ['approval_status'], reason: 'readonly' });
@@ -179,6 +181,7 @@ describe('batchData — per-row droppedFields + context threading (#3455)', () =
 
  it('update rows surface the engine strip and keep droppedFields when returnRecords=false', async () => {
  const update = vi.fn(async (object: string, _data: any, options?: any) => {
+ assertEngineUpdateDispatch(_data, options);
  options?.onFieldsDropped?.({ object, fields: ['approval_status'], reason: 'readonly' });
  return { id: options.where.id };
  });

packages/metadata-protocol/src/protocol.many-data-atomic.test.ts

@@ -21,6 +21,7 @@
 // test reads the store back afterwards.
 
 import { describe, it, expect, vi } from 'vitest';
+import { assertEngineDeleteDispatch, assertEngineUpdateDispatch } from '@objectstack/metadata-core';
 import { ObjectStackProtocolImplementation } from './protocol.js';
 
 const SCHEMA = { name: 'invoice', fields: { title: { name: 'title', type: 'text' } } };
@@ -47,6 +48,7 @@ function makeStoreEngine(opts: { driverCanTransact?: boolean; hasTransaction?: b
  const handle = { id: 'trx-1' };
 
  const update = vi.fn(async (_object: string, data: any, options?: any) => {
+ assertEngineUpdateDispatch(data, options);
  const id = options?.where?.id;
  const current = rows.get(id);
  if (!current) throw new Error(`no such record: ${id}`);
@@ -57,6 +59,7 @@ function makeStoreEngine(opts: { driverCanTransact?: boolean; hasTransaction?: b
  });
  // Contract per #4435: `false` is the positive not-found value.
  const del = vi.fn(async (_object: string, options?: any) => {
+ assertEngineDeleteDispatch(options);
  const id = options?.where?.id;
  if (!rows.has(id)) return false;
  rows.delete(id);

packages/metadata-protocol/src/protocol.record-not-found.test.ts

@@ -21,6 +21,7 @@
  */
 
 import { describe, it, expect, vi } from 'vitest';
+import { assertEngineDeleteDispatch, assertEngineUpdateDispatch } from '@objectstack/metadata-core';
 import { ObjectStackProtocolImplementation } from './protocol.js';
 
 const SCHEMA = { name: 'task', fields: { title: { name: 'title', type: 'text' } } };
@@ -34,13 +35,17 @@ function makeProtocol(rows: Record<string, any> = {}) {
  const store = new Map<string, any>(Object.entries(rows));
  const findOne = vi.fn(async (_object: string, opts: any) => store.get(String(opts?.where?.id)) ?? null);
  const update = vi.fn(async (_object: string, data: any, opts: any) => {
+ assertEngineUpdateDispatch(data, opts);
  const id = String(opts?.where?.id);
  if (!store.has(id)) return null;
  const next = { ...store.get(id), ...data };
  store.set(id, next);
  return next;
  });
- const del = vi.fn(async (_object: string, opts: any) => store.delete(String(opts?.where?.id)));
+ const del = vi.fn(async (_object: string, opts: any) => {
+ assertEngineDeleteDispatch(opts);
+ return store.delete(String(opts?.where?.id));
+ });
  const engine = {
  registry: { getObject: (n: string) => (n === 'task' ? SCHEMA : undefined) },
  findOne, update, delete: del,

packages/metadata-protocol/src/protocol.upsert-existence.test.ts

@@ -26,6 +26,7 @@
  */
 
 import { describe, it, expect, vi } from 'vitest';
+import { assertEngineUpdateDispatch } from '@objectstack/metadata-core';
 import { ObjectStackProtocolImplementation } from './protocol.js';
 
 const SCHEMA = {
@@ -59,6 +60,7 @@ function makeRlsEngine() {
  return visible(row, options?.context) ? row : null;
  });
  const update = vi.fn(async (_object: string, data: any, options?: any) => {
+ assertEngineUpdateDispatch(data, options);
  const id = options?.where?.id;
  const row = rows.get(id);
  if (!row || !visible(row, options?.context)) {

packages/plugins/plugin-auth/src/admin-import-users.test.ts

@@ -1,6 +1,7 @@
 // Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
 
 import { describe, it, expect, vi } from 'vitest';
+import { assertEngineUpdateDispatch } from '@objectstack/objectql';
 import { runAdminImportUsers, IMPORT_USERS_MAX_ROWS, type IdentityImportDeps } from './admin-import-users.js';
 import type { AdminActor } from './admin-user-endpoints.js';
 
@@ -35,7 +36,10 @@ function makeDeps(opts: {
  const where = q?.where ?? {};
  return existing.filter((u) => Object.entries(where).every(([k, v]) => { if (k.startsWith('$')) throw new Error(`fake driver: unsupported operator ${k}`); return u[k] === v; }));
  });
- const update = vi.fn(async () => ({}));
+ const update = vi.fn(async (_obj: string, data: any, options?: any) => {
+ assertEngineUpdateDispatch(data, options);
+ return {};
+ });
  const insert = vi.fn(async () => ({}));
  const warn = vi.fn();
  const noteMustChangePasswordIssued = vi.fn();

packages/plugins/plugin-auth/src/admin-user-endpoints.test.ts

@@ -1,6 +1,7 @@
 // Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
 
 import { describe, it, expect, vi } from 'vitest';
+import { assertEngineUpdateDispatch } from '@objectstack/objectql';
 import {
  runAdminCreateUser,
  runAdminSetUserPassword,
@@ -338,7 +339,10 @@ describe('runAdminCreateUser', () => {
  }
  return [];
  });
- const engineUpdate = vi.fn(async () => ({}));
+ const engineUpdate = vi.fn(async (_obj: string, data: any, options?: any) => {
+ assertEngineUpdateDispatch(data, options);
+ return {};
+ });
  const engineInsert = vi.fn(async () => ({}));
  const m = makeDeps({
  getDataEngine: () => ({ update: engineUpdate, insert: engineInsert, find }),