test: record-change and http-conformance fixtures follow the engine's refusal; type a mock

The record-change org-probe pin asserts the absent organization object is
quiet by construction; the conformance stack registers the authz resolver's
read set (unprovisioned) that its stubbed auth service never did; the
engine.test expand mock types its parameter (test-typecheck ledger).

Claude-Session: https://claude.ai/code/session_01DDZNkDVwPQnevTFcYE47H3
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/objectql/src/engine.test.ts

@@ -2067,7 +2067,7 @@ describe('ObjectQL Engine', () => {
             // (an in-process verb refuses a name it does not hold), so `task` is
             // registered; the REFERENCED object is not, and expand leaves the
             // raw id without a second driver read.
-            vi.mocked(SchemaRegistry.getObject).mockImplementation((name) => (name === 'task'
+            vi.mocked(SchemaRegistry.getObject).mockImplementation((name: string) => (name === 'task'
                 ? { name: 'task', fields: { assignee: { type: 'lookup', reference: 'user' } } } as any
                 : undefined));
 

packages/qa/http-conformance/src/conformance.integration.test.ts

@@ -44,6 +44,82 @@ const ADAPTERS: AdapterCase[] = [
  * parity) need the routes to exist. Pass false to exercise the
  * capability-absent posture: no mounts, shared 404.
  */
+/**
+ * [#21516] The objects core's authz resolver (`resolveUserAuthzGrants`) reads on
+ * every request. A deployment's auth and security plugins register them; this
+ * stack stubs the `auth` service instead, so they are spelled here with only the
+ * columns that resolver reads (no dependency edge onto either package, the
+ * precedent `trigger-record-change`'s integration fixture set) and registered
+ * AFTER boot, so no schema sync provisions them: the resolver reads missing
+ * tables and answers "no grants", exactly as it did when the engine still
+ * handed an unregistered name to the driver (which it now refuses).
+ */
+const authzResolverObjects = [
+  {
+    owner: '@objectstack/plugin-auth',
+    def: {
+      name: 'sys_user',
+      label: 'User',
+      fields: {
+        id: { name: 'id', type: 'text' as const, primaryKey: true },
+        email: { name: 'email', type: 'text' as const },
+      },
+    },
+  },
+  {
+    owner: '@objectstack/plugin-auth',
+    def: {
+      name: 'sys_member',
+      label: 'Member',
+      fields: {
+        id: { name: 'id', type: 'text' as const, primaryKey: true },
+        user_id: { name: 'user_id', type: 'text' as const },
+        organization_id: { name: 'organization_id', type: 'text' as const },
+        role: { name: 'role', type: 'text' as const },
+      },
+    },
+  },
+  {
+    owner: '@objectstack/plugin-security',
+    def: {
+      name: 'sys_user_position',
+      label: 'User Position',
+      fields: {
+        id: { name: 'id', type: 'text' as const, primaryKey: true },
+        user_id: { name: 'user_id', type: 'text' as const },
+        position: { name: 'position', type: 'text' as const },
+        organization_id: { name: 'organization_id', type: 'text' as const },
+      },
+    },
+  },
+  {
+    owner: '@objectstack/plugin-security',
+    def: {
+      name: 'sys_user_permission_set',
+      label: 'User Permission Set',
+      fields: {
+        id: { name: 'id', type: 'text' as const, primaryKey: true },
+        user_id: { name: 'user_id', type: 'text' as const },
+        permission_set_id: { name: 'permission_set_id', type: 'text' as const },
+        organization_id: { name: 'organization_id', type: 'text' as const },
+      },
+    },
+  },
+  {
+    owner: '@objectstack/plugin-security',
+    def: {
+      name: 'sys_position',
+      label: 'Position',
+      fields: {
+        id: { name: 'id', type: 'text' as const, primaryKey: true },
+        name: { name: 'name', type: 'text' as const },
+        active: { name: 'active', type: 'boolean' as const },
+        organization_id: { name: 'organization_id', type: 'text' as const },
+      },
+    },
+  },
+] as const;
+
 async function bootStack(makePlugin: () => any, opts: { withAnalytics?: boolean } = {}) {
     const kernel = new LiteKernel();
     kernel.use(new ObjectQLPlugin());
@@ -97,6 +173,7 @@ async function bootStack(makePlugin: () => any, opts: { withAnalytics?: boolean
     // insert fails with `no such table`, which the REST error mapper turns into
     // a 404 OBJECT_NOT_FOUND — a routing-shaped symptom for a DDL-shaped cause.
     await ql.syncObjectSchema('task');
+    for (const o of authzResolverObjects) ql.registry.registerObject(o.def as never, o.owner);
 
     const httpServer = kernel.getService<IHttpServer>('http.server');
     return { kernel, base: `http://127.0.0.1:${httpServer.getPort!()}` };

packages/triggers/trigger-record-change/src/record-change-integration.test.ts

@@ -104,6 +104,9 @@ const sleep = (ms: number) => new Promise((r) => setTimeout(r, ms));
  * real console, and COUNTS what it withheld so `afterAll` can assert the
  * expected reads still happen. A capture nobody asserts is a mute.
  */
+// [#21516] The engine now refuses a name its registry does not hold before any driver,
+// so the org probe asks the registry and never reads an unregistered organization
+// object: this read no longer happens, and the pin below asserts exactly that.
 const EXPECTED_ABSENT_PROBE_TABLES = ['sys_organization'] as const;
 
 /**
@@ -206,7 +209,10 @@ const noise = captureExpectedReadRefusals([...EXPECTED_ABSENT_PROBE_TABLES]);
  * assertion exists to make loud.
  */
 afterAll(() => {
-  expect(noise.silentChannels()).toEqual([]);
+  // [#21516] Quiet by construction now: the declared refusal no longer occurs. The
+  // capture stays declared (a returning read is still withheld and counted) and
+  // this asserts nothing was — so a read that starts happening again turns red.
+  expect(noise.tablesSeen()).toEqual([]);
 });
 
 /**