refactor(metadata-protocol): move the single-record data writes through the protocol host (#25467 E2 section 3) (#29788)

<!-- claude-projects-attribution: {"github_login":"os-warren"} -->
_Requested by **Warren** · [project
thread](https://claude.ai/code/project/chan_01U5RdnAAmkSQmZbqh6FtqZ8?thread=cmsg_01U5RdnAAmkSQmZbqh6FtqZ8GE36iJtj8qnMmT45cLJ7VY)_

Part of #25467

Clause-②: no
Metadata-protocol: none

## 维护者速读

- **改了什么**：把 `protocol.ts` 里“数据
CRUD”一节中四个单条写入方法（`validateData`、`createData`、`updateData`、`deleteData`）的方法体，经
E1 宿主机制原样搬进新模块 `protocol-data-writes.ts`；四个方法仍留在类上（签名与文档不变），方法体变成一行转发。
- **为什么改**：#25467 裁决 E 的 E2 第 3 节，在席位声明的 `protocol.ts` 冻结日内。第 2
节（查询校验）已由 #25538 搬完，无可切；第 3 节其余四个方法体按席位裁决 A（6594932448）暂留类中，原因见下文。
- **风险与回滚**：低。只做搬移：工具逐个证明 4 个方法体与原方法体在“`this.` 读作 `host.`”之外 AST
与文本全同；对外 `index.d.ts`（ESM 与 CJS）与 main 构建出的逐字节相同。回滚即整体 revert。
- **先看**：`packages/metadata-protocol/src/protocol-data-writes.ts`
文件头；`protocol.ts` 里 4
个方法的转发体；`scripts/engine-double-contract.seams.json` 两行路径。
- **两分钟验证**：`cd packages/metadata-protocol && node
scripts/host-split.mjs check origin/main updateData
protocol-data-writes.ts`，预期 `"ok":true,"textIdentical":true`。
- **需要你做的**：无，席位落地。

## What changes

Step **E2, section 3 "data CRUD"** of ruling E (6537939895), on the
`protocol.ts` freeze day seat 4 declared (6594835694 on #27737). It is a
pure application of the E1 host pattern: no logic changes, and no new
rewrite kind.

| member | moved to | rewrite sites (all `this.x` to `host.x`) |
|---|---|---:|
| `validateData` | `protocol-data-writes.ts` | 2 |
| `createData` | `protocol-data-writes.ts` | 3 |
| `updateData` | `protocol-data-writes.ts` | 5 |
| `deleteData` | `protocol-data-writes.ts` | 3 |

Each method keeps its docblock, modifiers and signature on the class;
its body becomes `return fn(protocolHost(this), …)`. `ProtocolHost` and
the class's static block gain 3 entries, all call-time closures:
`assertObjectRegistered`, `assertVersionMatch` and `probeRecord`
(`engine` was already on the host). `node scripts/host-split.mjs check
origin/main MEMBER protocol-data-writes.ts` reads `ok: true,
textIdentical: true` for all four, and the tool refused none. Negative
control, with `deleted === false` changed to `!==` in `deleteData`'s
moved body, then restored from `HEAD` (blob hash equal to the disk hash
afterwards):

```
PROBLEM protocol-data-writes.ts:286: ExclamationEqualsEqualsToken where the base has EqualsEqualsEqualsToken (`===`)
PROBLEM protocol-data-writes.ts: deleteData's body text differs from the base body rewritten and re-indented, first at body line 24
```

`protocol.ts` drops one import name only `updateData`'s body read
(`byIdUpdateRecord`; its re-export stays) and gains the import of the
four functions beside the 1b imports.

### Section 2 has nothing to cut

The order named section 2 (query validation) first. On main `c9c68288`
its 15 members (`assertObjectRegistered` through
`servesExpansionTarget`, lines 4881 to 5613) are all stubs of the
per-member series' `fn.call(host, …)` shape, with their bodies in
`protocol-query-validation.ts` since #25538 (cut 3, merged 2026-10-23).
No member in that range still carries a body. The seat re-ordered this
thread to section 3.

### Four bodies of section 3 stay in the class (seat ruling A,
6594932448)

This cut is under ruling E's 1,000-line guide on the seat's ruling. A
trial move of all eight bodies measured two gates that read the section
by path:

- **`findData`, `getData`, `cloneData`, `probeRecord` stay.** They hold
all 6 of the query-options erasure sites
`scripts/query-options-erasure-baseline.json` grandfathers for
`protocol.ts` (`findData` 3, `getData`, `cloneData`, `probeRecord` 1
each). In a new module they fail `pnpm lint` and the ratchet, and
listing the module is the move that baseline forbids (its key set only
shrinks against the merge base). Cut 4 kept `probeRecord` in the class
for the same reason. The seat is filing the card that types those
erasures; these four move after it.
- **`updateData` and `deleteData` move, and the engine-double-contract
ledger follows them.** Both are consumer seams the ledger keys by file.
`scripts/engine-double-contract.seams.json` is rewritten by `--write`
(two `file` values, nothing else), and the self-test's one wiring
assertion names the module instead of `protocol.ts`. The rule judged is
unchanged: before the ledger move the run read `SEAMS_RETAINED` four
times and the self-test failed on the old path (exit 1); after it both
exit 0, and the moved bodies still pass `REFUSES` (they throw
`recordNotFoundError`).

## Tests

No pin needed an edit. The read-verb pin, the lookup-artifact and
hydrate caller-set pins and the system-context census read nothing in
the four moved bodies. The query-transport-dialect pin and core's
second-object-read-exposure pin read `findData` and `getData`, which
stay.

## The published `.d.ts`

Built from main `7ba8b11f5` and from this head with the same dependency
build. `index.d.ts` is byte-identical: raw sha256 `3a15d153…f48075` on
both sides, ESM equal to CJS, so no normaliser is needed.

A measurement worth keeping: on the first base (`c9c68288`, before
#29730), `getMetaTypes()`'s inferred return type made tsc's declaration
emit print a docblock of `protocol.ts` chosen by character offset (the
comment leak 1a met). Any net shift of the text above the class changed
`index.d.ts`, and only a net-zero shift kept it identical (probed at 12
to 28 added characters; only 18, the exact compensation, matched).
#29730 gave `getMetaTypes()` a named return type, and on the merged base
the import stands in the import block with `index.d.ts` byte-identical.
The leak no longer constrains later E2 cuts.

## Serial

Merged `origin/main` twice: over #29730 (the `getMetaTypes()` return
type) and over #29753 (seat 4's flow-read docblock lines), both landed
during the freeze as the seat's post allowed. `git merge` was clean both
times, and `host-split check` was re-run against the merged main for all
four members. Seat 2's #29673 edits members outside this section and
this diff does not touch them.

## Verification

On `ae528b8277`:

- Package typecheck and test through os-verify-lock: `VERDICT
command-exit 0`; Test Files 310 passed, 4 skipped (314); Tests 22301
passed, 26 skipped (22327).
- `eslint packages/metadata-protocol
scripts/check-engine-double-contract.mjs --no-inline-config` exits 0;
`pnpm check:query-options-erasure` holds (44 sites in 15 files, none
new).
- `node scripts/pm/dispatch-gates.mjs --commands` derived 74 commands;
`--ran` reports 74 derived, 73 run, 1 NOT-MEASURED, 0 UNRUN. Each run
family exits 0 (`check:pm-dispatch-gates` 1945 fast-tier cases). The
NOT-MEASURED one is `check:dual-build-cjs-loads`, which needs every
package built (exit 3, PREREQUISITE NOT MET), so its reading is CI's.

## Human Minimum

- [x] 1. Schemas start as Zod; `packages/spec` holds no runtime logic.
(untouched)
- [x] 2. Every name I added uses the casing for its kind.
- [x] 3. No formatter ran; `pnpm lint` passes (package and changed
script locally; CI runs the whole).
- [x] 4. One issue, one branch off an up-to-date `main`, one pull
request.
- [x] 5. A change that publishes carries a changeset, and both
declaration lines are filled in here and in the changeset.
- [x] 6. `packages/spec` touched: n/a.
- [x] 7. No hand edits to `content/docs/references/`,
`packages/*/CHANGELOG.md` or `content/docs/releases/`.
- [x] 8. Title, body and comments are in English (the 维护者速读 block is the
dispatch template's).

---
_Generated by [Claude
Code](https://claude.ai/code/session_01JQwxbY46nuWPvjhNvMiZqA)_

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: objectstack-fleet[bot]

.changeset/25467-e2-3-data-writes.md

@@ -0,0 +1,10 @@
+---
+'@objectstack/metadata-protocol': patch
+---
+
+refactor(metadata-protocol): the single-record data writes move out of `protocol.ts` through the protocol host
+
+Clause-②: no
+Metadata-protocol: none
+
+No behaviour change. The bodies of `validateData`, `createData`, `updateData` and `deleteData` now live in `protocol-data-writes.ts`, reached through the per-instance host (`protocol-host.ts`). Each method keeps its docblock and signature on `ObjectStackProtocolImplementation`, and each moved body differs from the method body only by `this.` reading `host.`. The published `index.d.ts` (ESM and CJS) is byte-identical to the one `main` builds before this change. Nothing to migrate.