fix(spec): keep the hook-body capability table out of the strictness block's way

check:docs failed on the previous commit (inside the "TypeScript Type Check"
job — tsc itself was clean). The regenerated reference page had REPLACED the
whole capability-token table in content/docs/references/data/hook-body.mdx with
one line: "Keys `ExpressionBodySchema` declares (drift-guarded by ...)".

build-docs.ts takes the FIRST JSDoc in a module as that page's blurb. Putting
the strictness constants — which carry `/** … */` per the approval.zod.ts house
style — above `HookBodyCapability` handed its documentation slot to a private
constant, silently deleting the `api.read` / `api.write` / `api.transaction` /
`crypto.*` / `log` reference table authors actually read.

Moved the block below `HookBodyCapability` and left a placement note so the next
person adding a documented constant to this file does not rediscover it. Regenerating
now leaves content/docs/references untouched; check:docs passes.

The other two files were never at risk — their first JSDoc sits above the imports,
so the inserted block could not take the slot. That is also why only this one page
moved.

Verified: check:docs green, full spec suite 7136 green.

Refs #4001

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0147tNF4Snk7Ry1KGt4a5PY4

Author: claude

packages/spec/src/data/hook-body.zod.ts

@@ -3,6 +3,35 @@
 import { z } from 'zod';
 import { strictUnknownKeyError } from '../shared/suggestions.zod';
 
+/**
+ * Capability tokens a script body may request.
+ *
+ * The runtime sandbox enforces these — if a body uses a `ctx` API that requires
+ * a capability it did not declare, the call throws at invocation time.
+ *
+ * - `api.read`   — `ctx.api.object(...).find / findOne / count / aggregate`
+ * - `api.write`  — `ctx.api.object(...).insert / update / delete`
+ * - `api.transaction` — `ctx.api.transaction(async () => { … })` — runs the
+ *   callback's `ctx.api` writes/reads inside one driver transaction, committed
+ *   on return and rolled back if the callback throws. Requires `api.write`
+ *   alongside it to be useful (the transaction body still needs write access).
+ * - `crypto.uuid` — `ctx.crypto.randomUUID()`
+ * - `crypto.hash` — `ctx.crypto.hash(algo, data)`
+ * - `log`        — `ctx.log.info / warn / error`
+ *
+ * `http.fetch` is intentionally absent — outbound calls go through Connector
+ * recipes (separate spec) so they remain auditable and replayable.
+ */
+export const HookBodyCapability = z.enum([
+  'api.read',
+  'api.write',
+  'api.transaction',
+  'crypto.uuid',
+  'crypto.hash',
+  'log',
+]);
+export type HookBodyCapability = z.infer<typeof HookBodyCapability>;
+
 /*
  * ── Unknown-key strictness (#4001 data step) ────────────────────────────────
  *
@@ -21,6 +50,12 @@ import { strictUnknownKeyError } from '../shared/suggestions.zod';
  * The L1 schema additionally PRESCRIBES the L2-only keys rather than guessing a
  * rename: `capabilities` on an `expression` body is not a typo, it is a
  * misunderstanding of which level owns the key.
+ *
+ * Placement note: this block sits AFTER `HookBodyCapability` on purpose.
+ * build-docs.ts takes the file's FIRST JSDoc as the reference page's module
+ * blurb, so a `/** … *\/` comment above the capability enum silently replaced
+ * the whole capability-token table in content/docs/references/data/hook-body.mdx.
+ * Keep declarations that carry JSDoc below the first exported symbol here.
  */
 
 /** Keys {@link ExpressionBodySchema} declares (drift-guarded by hook-body.test.ts). */
@@ -65,35 +100,6 @@ const scriptBodyUnknownKeyError = strictUnknownKeyError({
     + 'limits or grants that were written.',
 });
 
-/**
- * Capability tokens a script body may request.
- *
- * The runtime sandbox enforces these — if a body uses a `ctx` API that requires
- * a capability it did not declare, the call throws at invocation time.
- *
- * - `api.read`   — `ctx.api.object(...).find / findOne / count / aggregate`
- * - `api.write`  — `ctx.api.object(...).insert / update / delete`
- * - `api.transaction` — `ctx.api.transaction(async () => { … })` — runs the
- *   callback's `ctx.api` writes/reads inside one driver transaction, committed
- *   on return and rolled back if the callback throws. Requires `api.write`
- *   alongside it to be useful (the transaction body still needs write access).
- * - `crypto.uuid` — `ctx.crypto.randomUUID()`
- * - `crypto.hash` — `ctx.crypto.hash(algo, data)`
- * - `log`        — `ctx.log.info / warn / error`
- *
- * `http.fetch` is intentionally absent — outbound calls go through Connector
- * recipes (separate spec) so they remain auditable and replayable.
- */
-export const HookBodyCapability = z.enum([
-  'api.read',
-  'api.write',
-  'api.transaction',
-  'crypto.uuid',
-  'crypto.hash',
-  'log',
-]);
-export type HookBodyCapability = z.infer<typeof HookBodyCapability>;
-
 /**
  * L1 — Pure expression body.
  *