feat(core): make enum its own field kind

[cuibonobo]

Summary

Makes enum its own field kind: { kind: 'enum', values: [...] } replaces { kind: 'string', enum: [...] }.

When enum was a modifier on string, nothing keyed on kind ever saw it. isCompatible() ignored it entirely, so a consumer requiring status: enum ['want', 'reading', 'finished'] accepted a candidate with a plain string status, which can hold any value. With enum as a kind, every exhaustive kind map (READ_COMPATIBLE, SCALAR_KINDS, jsTypeForScalar, contentSortEntry) has to account for it, so this kind of gap can't recur unnoticed.

• Read compatibility: a required enum accepts only an enum candidate whose values are a subset of its own, including inside arrays and objects. A required string or text accepts an enum.
• Drift: enum → string stays additive, the one kind change that is, because it accepts strictly more. string → enum and enum → text need a version bump. Removing values is drift; adding them is additive.
• Validation: defineType() refuses an enum with missing or empty values, non-string or duplicate entries, values on any other kind, and an enum key on any field ("enum" is a field kind, not a field key), so the retired spelling fails loudly instead of silently becoming a plain string.
• Hash: values is sorted by UTF-16 code unit, as field names are, so reordering isn't a change. The spec now names that order.
• Sorting: enums order as text, by value. The adapter conformance suite checks enum ordering end to end.
• Type handles: an enum can widen in place, so a typed read can't promise a closed union. TypedRecord content is StoredContentOf<S>, which reads an enum as its listed values or UnlistedValue (string & {}). Typed writes (ContentOf, PatchOf) still take only the listed values; the stored schema's runtime validation decides what lands.
• Typed subscribe: a record that migrateAll() moves off the handle's version still matches the filter by its previous typeId; it now arrives without record instead of throwing in the dispatcher before the handler runs.
• Migrations: migration() types both sides as StoredContentOf. A step carries an unlisted value through rather than losing it, a lookup keyed on only the listed values does not compile, and migrateAll()'s runtime validation refuses what the target rejects.
• Conformance fixtures: a 422 for a value outside the list and a 409 for removing values.

Trust boundary

Data is validated where it enters a stack: public API calls and wire requests a server decodes. What an adapter returns is trusted to match its type, adapter-api included, since its server is held to the wire contract the way a storage engine is held to the adapter contract. This PR adds that rule to AGENTS.md and CONTRIBUTING.md § Architecture conventions, and so carries no guards for hand-edited stores (missing values, unknown kinds).

Spec

docs/spec/data-model.md:

• § Types: the enum kind, why it is a kind rather than a constraint on string, and the hash's sort order
• § Schema drift detection and § Additive evolution within a version: enum → string is additive
• § Type compatibility: enum row and column in the table and prose, the subset rule and its caveat about in-place widening
• § Type handles: StoredContentOf; a typed read types an enum as its listed values or any other string; a record migrated off the handle's version arrives in a typed subscription without record
• § Type migrations: both sides typed as StoredContentOf; unlisted values carry through
• § Sorting by a content field: enums order by value

Verification

pnpm run format:check, check:refs, lint, test, build, typecheck: all pass locally. The new typed-subscribe test fails without the fix (the handler never runs and the dispatcher throws).

Notes for reviewers

• The modifier form has been published (see the core CHANGELOG), so this is a breaking minor. Per AGENTS.md there's no compatibility path; the enum key is refused, not translated.
• TypeScript does not narrow x === 'want' to 'want' when x includes string & {}; the default branch of a switch does see UnlistedValue. Passing a read value straight back into a typed write therefore needs the literal, which is the honest typing: the value may be unlisted.
• A migration step can now emit a value the target handle doesn't list without a compile error; migrateAll() catches it at write time, and a typed read already types it as UnlistedValue. Migration output read live (presentAt: 'latest') is not validated for any field; that is outside this PR.
• page.collection.order in commons is a natural enum but is left for a separate change. The format fields stay string on purpose: they're open vocabularies.
• @haverstack/adapter-conformance gets a minor: the new enum-sort test can fail a third-party adapter.

🤖 Generated with Claude Code

https://claude.ai/code/session_01PQamMFa1B7kk8RTmzoTdqQ
https://claude.ai/code/session_01MGpKBNfBMZv8ijfQwoEqyK
https://claude.ai/code/session_01265RetnERff8vRLus836Zk
https://claude.ai/code/session_01BHk2jVPk24WLxWVGekNdqY

[changeset-bot]

🦋 Changeset detected

Latest commit: f607ebc

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 11 packages

Name	Type
@haverstack/core	Minor
@haverstack/conformance-fixtures	Minor
@haverstack/adapter-conformance	Minor
@haverstack/adapter-api	Patch
@haverstack/adapter-local	Patch
@haverstack/blob-adapter-disk	Patch
@haverstack/blob-adapter-s3	Patch
@haverstack/commons	Patch
@haverstack/record-adapter-do-sqlite	Patch
@haverstack/record-adapter-sqlite	Patch
@haverstack/wire-types	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR