db.select() returned every column including userId; spec §4.9 defined the response row WITHOUT userId. The leak is harmless today (user queries their own rows) but expands the public API surface beyond the spec, and would become part of the contract once Task 10 generates client types. Switching to explicit column projection.