# TeaQL TypeScript Ensure Schema Installing `GENERATED_RUNTIME_MODULE` is passive. Reconcile schema explicitly after creating the application-owned data service: ```typescript dataService.install(GENERATED_RUNTIME_MODULE); const context = new UserContext().insertResource("dataService", dataService); await context.ensureSchema(); ``` The generated module is the source of truth for both entity schemas and System Bootstrap Data. Explicit `context.ensureSchema()` performs DDL reconciliation, guarantees the Default Domain Root with ID `1`, creates or reconciles generated constants, and advances ID-space floors beyond every bootstrap ID. A repeated call must be idempotent. Do not confuse System Bootstrap Data with ordinary sample/demo data. To use the default Data Graph, query the generated Domain Root with ID `1` and install it as the Context Root. To create an additional Isolated Domain Root, use the generated create API without assigning or predicting an ID; IDs are opaque and need not be contiguous. Never attempt to create another Domain Root with ID `1`. Never copy module schemas or bootstrap metadata into a second array, and never write parallel DDL or seed SQL. Propagate provider failures from startup or a dedicated administrative command. Do not invoke Ensure Schema per request, from liveness, module installation, or telemetry setup. --- ## TeaQL seven-language assist contract Apply the verified Rust semantic ceiling while using only the exact TYPESCRIPT generated and runtime APIs. Discover APIs through the generated application AGENTS.md and progressive model-aware Assist. Do not inspect generated domain-library source. - Do not create plurals by appending `s` or `es`; use the centralized generated plural. - Human and non-human entities use different generated predicate vocabularies. Preserve forms such as “who are active” and “whose email is”; never infer them from English. - Configure filters, projection, paging, and other query options before `purpose(...)`. Comment may appear anywhere in the chain. Purpose enters the executable stage; execution requires both values, but comment does not have to immediately precede purpose. - Every execute/list/stream and every save accepts exactly one context argument: `UserContext`. Name that argument `context`, never `runtime`; data services and global policy are injected when the context is built. Reserve `runtime` for process-level runtime ownership, provider/pool setup, and module assembly. - Tenant, merchant, identity, permissions, request policy, purpose policy, hard limit, and continuous-page cursor policy come only from trusted context, never dynamic JSON or TFP. - If the required operation is absent after current entity/action and required field Assist, stop that path and report MISSING_ASSIST. Do not guess an API or search the generated library as a fallback. - Create each application-owned source file once. After its first compile attempt, repair only the smallest block identified by the exact compiler or test diagnostic. Preserve unrelated code; do not rewrite the complete file as an error-recovery loop. - Before a repair that would replace more than 25% of an existing application file, stop and report LARGE_REWRITE_REQUEST with the file, exact diagnostic, reason, and estimated scope. Initial creation and model-driven regeneration are not repairs. Capability: `ensure-schema`. - Runtime Module installation is a passive manifest operation. Schema changes occur only after an explicit ensure-schema call by application startup, an administrative command, or an isolated test fixture. - Use the generated module metadata as the only entity list; never duplicate descriptors or maintain parallel handwritten DDL. Propagate provider failures. - Do not run schema reconciliation per request, from liveness, telemetry setup, or as an implicit side effect of module installation.