fix(runtime): keep the tracker id out of the refusal STRING, and pin on sqlite

Two gate-driven corrections to the refusal, both mechanical:

- `check:doc-authoring` — a runtime message reaches authors and operators who
  have no tracker to resolve `#NNNN` with, so the card id moves to the `//`
  comment above the constant. The changeset's quoted message follows, and now
  quotes the envelope key list the refusal actually prints (measured: 12 keys).
- `check:driver-memory-census` — the real-engine pin bound
  `@objectstack/driver-memory`, whose consumer set #5704 froze and #6664 ruled
  to a ledger; a new binding there is a maintainer ruling, not bookkeeping. It
  binds sqlite `:memory:` instead, which is what #5704 migrated the test
  backends to. Nothing about the pin needed that driver: what has to be real
  here is the ENGINE, because the null exemption is the engine's.

Claude-Session: https://claude.ai/code/session_01JbZnqu8bt6YqfJsr9vaFb3
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

.changeset/15124-action-engine-facade-find-query-envelope.md

@@ -62,7 +62,9 @@ handler — nothing above reaches you, so the facade refuses the withdrawn shape
 ```
 find('task') was given a key 'status' the query envelope does not carry.
 ctx.engine.find(object, query) takes the engine QUERY ENVELOPE, not a bare
-filter — move the filter under `where`: find(object, { where: { … } }) (#15124).
+filter — move the filter under `where`: find(object, { where: { … } }).
+Envelope keys: context, cursor, distinct, expand, fields, limit, offset,
+orderBy, search, searchFields, top, where.
 ```
 
 ⚠️ **That refusal matters most for a filter whose value is `null`.** The engine's

packages/runtime/src/action-engine-facade-find-envelope.test.ts

@@ -44,7 +44,7 @@
 import { describe, it, expect, beforeAll } from 'vitest';
 import { assertEngineDeleteDispatch } from '@objectstack/metadata-core';
 import { ObjectQL } from '@objectstack/objectql';
-import { InMemoryDriver } from '@objectstack/driver-memory';
+import { SqliteWasmDriver } from '@objectstack/driver-sqlite-wasm';
 import { buildActionEngineFacade, ACTION_ENGINE_FIND_ENVELOPE_PRESCRIPTION } from './action-execution.js';
 
 const deps: any = { resolveService: () => undefined, getObjectQL: async () => undefined };
@@ -185,10 +185,19 @@ const PROBE_OBJECT = {
     },
 } as any;
 
-/** A real `ObjectQL` over a real in-memory driver, seeded with three rows. */
+/**
+ * A real `ObjectQL` over a real driver, seeded with three rows.
+ *
+ * sqlite `:memory:` rather than `@objectstack/driver-memory`: #5704 migrated
+ * this project's test backends to it and froze the memory driver's consumer
+ * set, which `check:driver-memory-census` holds to a ruled ledger. A new
+ * binding there would need a maintainer ruling, and nothing about this pin
+ * needs that driver — what has to be REAL here is the ENGINE, because the
+ * null-exemption this block is about is the engine's.
+ */
 async function makeRealEngine() {
     const engine = new ObjectQL();
-    engine.registerDriver(new InMemoryDriver({}) as any, true);
+    engine.registerDriver(new SqliteWasmDriver({ filename: ':memory:' }) as any, true);
     await engine.init();
     engine.registry.registerObject(PROBE_OBJECT, 'test');
     await engine.syncSchemas?.();

packages/runtime/src/action-execution.ts

@@ -1476,9 +1476,12 @@ export function buildActionApi(_deps: ActionExecutionDeps, ql: any, ec: any): an
  * would stay green against any unnamed `Error` at all, and the pin has to
  * compare text.
  */
+// The card id stays in this comment and out of the string: a runtime message
+// reaches authors and operators who have no tracker to resolve `#NNNN` with
+// (#15124, and `check:doc-authoring` enforces it).
 export const ACTION_ENGINE_FIND_ENVELOPE_PRESCRIPTION =
     'ctx.engine.find(object, query) takes the engine QUERY ENVELOPE, not a bare filter — '
-    + 'move the filter under `where`: find(object, { where: { … } }) (#15124).';
+    + 'move the filter under `where`: find(object, { where: { … } }).';
 
 /**
  * The envelope's own key set, read off the DECLARATION rather than restated.